{ "Event": { "published": true, "date": "2026-08-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-10", "timestamp": 1786406581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fc446c35-d2e7-425a-87bf-02ff1bbaa124", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ffaf67-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "6cc2ea88-6c17-4c8e-a72d-e14f7165f524", "comment": "Malware payload (Formbook)", "value": "bfdf44231cf6eb52b68e337bd8ef0834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "a8cc77df-ef69-4bbb-b697-61af46b04ff0", "comment": "Malware payload (Formbook)", "value": "00039bbee16af377452f9ba193a61fbc238ccaf8be4165574192f10bf68344db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "961da680-23d9-4c52-95db-13cb1da0445c", "comment": "Malware payload (Formbook)", "value": "366be91cdf3c02cc48a9c301b0ef10f1bf76c3b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "19ce869b-7aba-48d8-a9c0-9a5e849672f9", "comment": "Malware payload (Formbook)", "value": "f3071176160853e784d6fa2620f00372c75a11e374ea2cc61771484c3252e54c48a2968e4030873c2aa8b5313c114032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "3abb80db-81b2-4fd0-b5cb-943c98dacd8e", "value": "T11B2522152695EA17CD961BB50BB0F3B823785DD9B900E3279FE9ADEFBD36A105D00082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "48fae14b-3993-411f-811c-65db697697f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "1af8acac-df14-4d82-b660-ff6745647039", "value": "24576:CSO6py5EomdgiNBM/PEmz/jHzV1caVsMwyValkfw:hw5Eomd9mPTLjzzch/yVal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371656, "uuid": "693a8efc-13fe-4390-98ee-b4f5aaf14d9f", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371656, "uuid": "c067ccc8-8793-429a-bcb9-0a0fba74787c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "f3c5d190-5eb5-45cb-8ec7-13e13703faad", "value": "00039bbee16af377452f9ba193a61fbc238ccaf8be4165574192f10bf68344db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca3fc1c-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "a076eb88-7604-49e8-b5cb-49f82337b4ca", "comment": "Malware payload (Mirai)", "value": "9fdc50e844e1376a149c0ec2ec6ba1d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "a13036c9-4ffc-44f4-a8db-80af41c24af0", "comment": "Malware payload (Mirai)", "value": "0017ec0b36f0a10e37951329126e28d8bf03030124de8001061ee3c9193b4481", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "f8fb3128-dae7-4cd3-b402-2ce288b9831e", "comment": "Malware payload (Mirai)", "value": "ac5e1786710ca349f5b0fbbe353de44215e40a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "10ce0928-6a25-4b35-b1a0-083b6e3524a2", "comment": "Malware payload (Mirai)", "value": "83bae8e10a8d06f20722599770c8385b388570143f4de69b723ef8e8a0e649e8ead651e225fbf2ebe132014cefc71e15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347190, "uuid": "9bb45604-980b-49ee-aacf-fa411b17c0ac", "value": "T1D4733919B9519F1BC2C21637FF2E8349331723A8E3DB7203DE15AF55339B62A0E2A455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347190, "uuid": "a0621e42-269b-42c9-856e-1be274c7f250", "value": "1536:tg77nl5e+mgYUkOTWN+WfKu8TGp/kYvQnMOZcnESFqE20XgQN:tg77log06WN9fKu8TG9rQMQ0ESFqE2Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347190, "uuid": "ba4987ff-af1a-41d0-93ef-efcdc54967ca", "value": 75624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347190, "uuid": "11dc4614-34ab-47d9-8ed7-d126146c9e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347190, "uuid": "df770e8d-b7cc-4327-90c3-e396fa417829", "value": "DjEq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc848519-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "1281d476-b262-4a1e-8430-297acf4a5d02", "comment": "Malware payload (Mirai)", "value": "6d9b7701af997b029acf62a4c57e2c63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "940c44f2-f6c4-4cd9-89e7-7f6d548a2e93", "comment": "Malware payload (Mirai)", "value": "00a9a0864035e994f255c3bdbcebb5c860844555bf279aa711462f86b0f11e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "deeafbb3-6bbf-4f24-b366-8e2c6defa063", "comment": "Malware payload (Mirai)", "value": "9e8456b975c87c3f5141b7d368d605219e836152", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "c2dff772-f21b-4393-8592-9597ef9c5c50", "comment": "Malware payload (Mirai)", "value": "4e2814ea60f8e4345c08bef5ce0a77723da7d8c95609bb12ed09a47367baf2add401228876b36b2670a8117275d0e9f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339915, "uuid": "8915a966-991c-4bd1-b9a5-51b447ef7936", "value": "T19984298882F5FBDEE296FA3983047D0B5C214B367083758561AEF96313B72450AFDDA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339915, "uuid": "b8ddd450-60db-4a9d-b0c4-7f1d012fbc5b", "value": "6144:LQD4/VelUWGaVyFLSRlzr7cC7qe+t0MzWLvCrthIor:gaelUW7yg797qcTCrXIor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339915, "uuid": "d50ee8c8-8165-46a9-8df0-043c81b82b9c", "value": 382396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339915, "uuid": "302fc551-90f7-4d6b-88f5-d2f79f7471cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339915, "uuid": "7d3ac05f-38b0-4d97-9c90-7e91e4f18c71", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60a98c5-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "8af49b11-f51d-4095-81df-950243fb2804", "comment": "Malware payload (Vidar)", "value": "94d210eb70c4f5618fc8e2e42dc255fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "a9d883ed-dab5-49a4-a68f-126cd4e6f407", "comment": "Malware payload (Vidar)", "value": "00cc775fb18128c434bd5703f4dd29fca48b68791bbc2f9bfa8eb9c3ba7d2a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "9bda444b-591e-4341-99dd-9e41067cf97b", "comment": "Malware payload (Vidar)", "value": "f2cd6a749538c3d57cefa4fb1bd998f6e6a46c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "5e2a3125-1980-4ec3-98dc-fb367568a365", "comment": "Malware payload (Vidar)", "value": "12be8f1f9d427a8c48b8b41ab9a77ff2cc510ca1334da39b684958c021b3f11b83dbe0e84acf8273efb8939e6193ecc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "778a024e-726a-4afb-9edf-40b498a35e4a", "value": "T11A826246E25BA1B8C4F7C737939A412656F9BC40223696376FED86711D93330FA182EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "c7836c21-052f-4cad-9efb-3c70e5285ab0", "value": "66ebb7345b7f4b21730e0a314cb2039c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "9ba3a65d-ae84-4558-a349-8d9366f0f177", "value": "384:OuB3GKyPfMMOIpkVw5T8J81ZTubL9MfDdkx0kUnhwb37+Yd1l:PVi5OfVwhl7d0b3735", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369163, "uuid": "749cbbfc-80be-4003-a12b-fad08498329a", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369163, "uuid": "59b6f915-5521-499b-b02a-aaf6fc108538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "5aef5824-61be-429c-bd96-e09a27531f73", "value": "00cc775fb18128c434bd5703f4dd29fca48b68791bbc2f9bfa8eb9c3ba7d2a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a371b344-94aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786359603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "6818206d-7c1d-4e8c-b719-dee7fde7da3a", "comment": "Malware payload (Formbook)", "value": "cdd54ad599d195175f9a2cbb41c2032f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "27d079f6-39e3-4e89-9548-483d954af30b", "comment": "Malware payload (Formbook)", "value": "00d9e0c440cc5d6c65a4bd401afb58c2198a281793f4c8aaa1e14ce096d77727", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "67b79e68-c968-4b13-86f0-491202c62cbd", "comment": "Malware payload (Formbook)", "value": "ec8bde76752cce88891f6a5319db358e2b23a705", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "074dd244-9b79-465a-b3f8-07569ad3aa9d", "comment": "Malware payload (Formbook)", "value": "0c194761af0d6d88bd68ad10877eee320e7a979ccfc0b8dbb373568396638f2d1497799bd0685ffc075ca2a0fac80481", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359603, "uuid": "8e39f9eb-0e2b-48b7-a6d2-39ca26417c63", "value": "T1C553DC549A82758453337B7FB62BA8A0F6760B6B40440917F87CB4909FF1D09EBE1CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359603, "uuid": "fd3e668c-cc01-4126-9cb5-c685cb3cdd08", "value": "768:DcUKceQFwKjoYfpCQRh2LmtQ60H8zTidHBpQZzf8m5dtwEmw6MScQXak/OGnidjO:Dukzf8m5dtw/2AuuQERvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786359603, "uuid": "2baf4736-683d-456c-8c8d-aeefc6b5dcb3", "value": 61459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786359603, "uuid": "d0d9a238-f723-41a0-afe3-fbf7d114b65a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359603, "uuid": "7b685d16-b955-4db7-aff8-1acd83960235", "value": "1-TECHNICAL SPECIFICATIONS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8fdb21-9474-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786336427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "760c8da0-0e7a-4ce2-b607-5972b4a8ad24", "comment": "Malware payload", "value": "21f3d7ec5751632c8fe9c03f99c87a0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "b9914ad5-e3d0-4d77-8cea-8f8dda6bf288", "comment": "Malware payload", "value": "00f4aa14a269af928879575ce7120518da3d38fe5693921e50c618ee9feb84e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "8a2d1bf1-d965-4f94-b33e-72feebd21673", "comment": "Malware payload", "value": "60cd43d460420b7b16083ca6a665968418fb76f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "debf5faa-6c59-4d5d-afb3-86ad6eb1c570", "comment": "Malware payload", "value": "6b80a519191f3e34f6ff826e7e3437533fa6bca7ae125e25c993cf33eec340eb238fd5197628801a1bc2eb2dc3764a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336427, "uuid": "f8636da5-2262-4b65-b008-07c72206890b", "value": "T16523C31BB6A3B47CC24BC0B45A9AD5F1B93178B402213D3FA3C5FA312E35D516A59E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336427, "uuid": "b5e3f7d3-46d6-4d3b-8de8-1ae9010ab77a", "value": "768:p6axsI+h+ZqquUAi5pY38uCfkeGxgXw3wEalljXTJ:8axsI2IAi368jGxgXw3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786336427, "uuid": "436bf75b-923a-4f79-999d-25208f11bbd3", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786336427, "uuid": "9f94e5f9-8302-46a4-9f0c-0c77f2dee6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336427, "uuid": "c44626e1-a5d4-4d81-b90b-e096c96254f1", "value": "00f4aa14a269af928879575ce7120518da3d38fe5693921e50c618ee9feb84e4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6e4a9f-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786372877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "79c36b03-64d7-4005-aa20-dce15e0e5e32", "comment": "Malware payload (XWorm)", "value": "d19a0e99402b2aa9062032cfbc58a558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "5da43a8b-e13c-4886-9da2-883c72793a51", "comment": "Malware payload (XWorm)", "value": "0128fb60a5557d520ecd0d61f4b442317ff668deef20f9ee64264c20cf299285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "754f2126-1fb1-4f7f-b534-ddd4bfe9aa5b", "comment": "Malware payload (XWorm)", "value": "0f2565f1e43bfe85ce87c1fdbedfa82a4a1dddca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "e0436e10-01d9-4953-a40e-d48398c9c2c3", "comment": "Malware payload (XWorm)", "value": "a7bb517da54e04dcc03595e16a095b81b536c1e82a7be80c66514addd32eb211a77379de8d2f8450a2d7e8fde48721f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "3acca9c6-2b55-40b2-84b9-12c07ef7b755", "value": "T1B394BF523D0CA8D7EE3D6372286785862FB4787A4BD215AB7AAFF25648113034E1FD1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "f89ba9b0-ad02-44b4-93b7-c20fc9da7a88", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "2740c787-6d76-49f6-8b73-7ed08cd243ed", "value": "6144:vwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437A28LOB4XoWSpe3IY:vzhufPAgEYFV5Lg4YpA4eM0bCy8wyix7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372877, "uuid": "67cda7b9-c1e1-4727-bdcb-5e396e93a46e", "value": 409384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372877, "uuid": "82fdd66b-6ef8-4c4d-bf31-b61bc7659553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "92db20e8-5a49-4558-8b74-188f8a1de68e", "value": "0128fb60a5557d520ecd0d61f4b442317ff668deef20f9ee64264c20cf299285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84ce60f-94f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786389703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "53984721-9e5d-4c57-bbd1-ec63e96bd435", "comment": "Malware payload (Mirai)", "value": "6daa27df6d8e3f5895976033dde7f341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "c5bb82db-ae08-4973-9bb1-a84fbfb302bb", "comment": "Malware payload (Mirai)", "value": "014bbcf2d56904052a3f82d384d92d6146e5b903bbc0f09b265aa84571455f2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "6014eddb-ffe3-4593-bcd0-da7ccea95465", "comment": "Malware payload (Mirai)", "value": "301cfe01cf8288aae57a37ee6dcca3a996e9533d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "fa6592a3-2a3d-4f58-83f8-c5b15e50349c", "comment": "Malware payload (Mirai)", "value": "656d1634ed682e876c4eab235f830faf45b748caf542d8c232736a74b78355d20bca302b3ba67343e5882cb6eea3ed0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389703, "uuid": "309c1af1-aed1-4100-a434-0d8897d2afe3", "value": "T154D30945FD418F16CAC265BBFF4E438C7B2A1769D3EE720399255F20379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389703, "uuid": "241e4ecb-1feb-41a7-8f7e-737d4e26c0bb", "value": "3072:e29eC2y4vb3OQLuJdH/uwZCcwcAPDSH03lniYj0/HXx:99eC2y47E5GwZCcwFDO01iYj0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389703, "uuid": "072d643c-d054-404c-8cbf-16c49cc34526", "value": 142776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389703, "uuid": "b22ff7b3-4918-4cf7-b4ec-0bcf8a159624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389703, "uuid": "23b02883-10f2-4d26-81f2-9ce0fa6de2fc", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3764f7-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "d14e92e3-e0ef-4ca6-b2ce-30efd38b75ef", "comment": "Malware payload (AgentTesla)", "value": "08656ee19ec4be761299611840e593a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "63a87fee-bf77-489a-9511-9f8d2d76dbe7", "comment": "Malware payload (AgentTesla)", "value": "018deb8ea5ecec507e0261f58ec3dde7843f85c316fecbd26b9eac8e336ac727", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "af6d0dde-3ffc-4ddf-8ed2-3c783fbdbaf6", "comment": "Malware payload (AgentTesla)", "value": "f3533dc17374a810c4fc1fc85b54f0555f5adf54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "6ac6901d-1c9e-4e86-a1d9-1fd77613ca8c", "comment": "Malware payload (AgentTesla)", "value": "02f1c3ec7c8a51b613f562d1010e939ef0427bcbf5f8982340c19e35ee546ba697052c0bc5e7ed65cbc0ce425ae9af64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "08a95950-b682-40f7-a3a7-fa99ea8db3c7", "value": "T129250151232A9A52E0D6CBF6BD20D37033A50ECF38D2C3925FE66FF774297851A44692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "e6daac9a-fa26-4a78-b733-6d5f43e175c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "dc449e77-49dc-48fe-bf16-20cef8d82e6a", "value": "24576:OTFYx7OIdexshWrgdvEAd44gNQRNcbCbMhqfQQhbp50:xdeuhs4BNcyMIYQdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373093, "uuid": "164429d4-6df6-4d7b-b383-ad6bd81793ed", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373093, "uuid": "c27e6aad-941d-4809-95cf-97eed81cb313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "2a4aa806-c31a-410b-b8c9-2c125861531c", "value": "018deb8ea5ecec507e0261f58ec3dde7843f85c316fecbd26b9eac8e336ac727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25cef94-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "9c8193c4-6c60-48c9-a2cb-4e6b9102b62f", "comment": "Malware payload", "value": "6e3febcd3330001b6608d8de7f35e7b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "7d077577-8d07-49c1-bcdf-90e21a307bc2", "comment": "Malware payload", "value": "01978a95769418d0c985edc3b54e45e550ed9832f5b4ca710a6cedff7a42348d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "5a71961a-de0e-49db-ac3f-23fd97023710", "comment": "Malware payload", "value": "ddd8947b2dc8783808492d52cd37ee7264f3bc4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "6a0fceda-7677-4f78-85fe-c5adba202a20", "comment": "Malware payload", "value": "637aafabd3bf0a8b00ea5a6b780e5ff6823394d1ce6167a29cf04a467bb9e03f627c9c7abb2417a540aebfdfbc685ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "2d35e57a-ccb6-480b-9610-4e25deaeadba", "value": "T1F665DF45D9C405A0ECA9AB31A675CC7446B27DAE6830E61D24CD3EFB7FB73836012663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "106e732c-aa21-4149-b16c-e429fff32d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "972fde98-86e3-4065-9f29-1aa1ba8c62dd", "value": "24576:iYJE26xuUum89aFt5sO4qFfrYEzRDtMfLhZTEi81q:Rp9s89aL4yf0+RxuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373855, "uuid": "3ebefb8e-b916-408f-b86e-54eeac1bfcf7", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373855, "uuid": "9406e9d9-c45e-4f3f-8926-636ca60d8fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "5ed29e71-ecee-4a52-a358-cf9b8cd517de", "value": "01978a95769418d0c985edc3b54e45e550ed9832f5b4ca710a6cedff7a42348d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6361328e-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786372810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "afdd6c5a-b0cb-47db-8301-00c774f34efb", "comment": "Malware payload (MassLogger)", "value": "c023f0fd63a3ed5d50299d7aa4af1e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "0e29ddba-fbd4-4fe0-ba89-dd9ed984ce93", "comment": "Malware payload (MassLogger)", "value": "01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "f409d50f-065a-4048-9ffc-24c36ee7f867", "comment": "Malware payload (MassLogger)", "value": "be70dbedfd79d3d7e3146e08cdbec5701329c39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "7456d683-fc7e-414d-990e-f3cd2825d963", "comment": "Malware payload (MassLogger)", "value": "7ec543ba3949522f12b56cf44d4da7dcc9ac72718ead11b011a6c85d9202d514501dfa64faecaed71e1b77c3a6ce2bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "196e263f-c1f8-45c1-a31d-6b72a8c31994", "value": "T12D05F1151316DA41E0E68BFAB8A0D37533790DCF7AE2C3969FE96FFB38153805558282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "97858985-0d4e-4b81-82da-dbaeb83bba7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "0fc38ab8-47f5-470c-8a92-a9d54bd5137a", "value": "12288:vxxltnn0gGfnQkfXfFRp1z2VXXFNOX8vlZk4ZfMce8+6m51IPB0/Dsn:vp50bQkfXdRpleX1JOM0ceMmk0/Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372810, "uuid": "f0381349-d5d0-4e98-947f-b028dd684d35", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372810, "uuid": "2b1a3cc7-1eeb-4195-b1ec-0029f3385a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "424e1aa5-d845-41d7-a4f3-f8910721ed8e", "value": "01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe18c64-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "6767f814-b3fb-4c6e-b4ca-db3790fdd201", "comment": "Malware payload (Vidar)", "value": "89a36b401a7b2c1c6264527cc18da6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "1ed55052-d2c1-49c9-b7bf-a8396a44544c", "comment": "Malware payload (Vidar)", "value": "023158a37cbae730c63eee626a396dc22f305ace61471498e13b4b1f36356502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "f2f2e917-3107-492e-8d7f-9dce898e8a92", "comment": "Malware payload (Vidar)", "value": "f9f0d2cb4df5e79dac85a1bf1d116589364056f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "4e040d38-1357-40d5-8050-b5f5b67a7db5", "comment": "Malware payload (Vidar)", "value": "19a4f783401dbcc1dfae6ca5d42befbc0325eede0dc209d1a078a804d2e810b47779c36945b0263414dd38889e29f50d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "20085a8d-1038-4f37-aa30-9f5ac2307eab", "value": "T193824044E11BA2B4C4EBC337936A522356F8BC052631963A6FEC5A325D52730F6186FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "75ea771a-ced8-42aa-b590-f1ea93b0203e", "value": "351526ecdd2e2b685a290935bb32a240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "93fc0d99-6bd5-4527-9550-de98e9602471", "value": "384:O23lKoXX1dLwdvNgmuVgXHM5Py1fs7dKcchKtBbVqojy6Vl:hlKE1Kgm6y1rhwkSys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369583, "uuid": "4e00ed3d-a1ea-4e78-bcd2-08fe9990b86f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369583, "uuid": "200240b9-9069-4bd4-8c5d-6a9d27ea41b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "2e89ef42-fb75-43af-a814-073c345de897", "value": "023158a37cbae730c63eee626a396dc22f305ace61471498e13b4b1f36356502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4dbe18f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "8924259f-0ef8-492e-9e02-6a12c5d7df9a", "comment": "Malware payload (AsyncRAT)", "value": "a18c0d2d31da3b0d474fbde83cab5bb4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "6c64351d-52d7-44b4-b72f-47b3ba5ecc56", "comment": "Malware payload (AsyncRAT)", "value": "02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "f46e3114-857a-4a2b-9d50-ffbb58183daf", "comment": "Malware payload (AsyncRAT)", "value": "6c854521579190958e7c90c3e72526268cd359f8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "ed96aa45-f4f0-4485-8fc9-c5ed1d3c51dd", "comment": "Malware payload (AsyncRAT)", "value": "a04309570516d6b53cbb91df62d4a579033aa6a7a4eaa042127c430b81d41f91d41bf51ccea9a68da5dd3fd138c5ef1a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "0f8f4a36-33b4-4410-84a5-caeb762d0163", "value": "T18CA5BD15E3D821A8D427DA38CB54A333D2B1B9224B75E48F0A99C3061F77A919FBF711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "5787158d-6d84-4fa5-8f86-533fb2bc0f76", "value": "65e41035c05e4ebec29685fad2d2799b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "2ad3015a-f328-42ad-9666-ef52e29639a7", "value": "49152:VAIkXxxl0mFiaPgq0P1QBhQKLwyFrkuaUEXeo5I4Nbekxo41C2LJr/:iPATqPUuaUEXeo5I4Nbekxo41C2LJr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373403, "uuid": "e3223d18-12f4-4712-b40c-223ca82b5bb2", "value": 2096128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373403, "uuid": "355df08c-3559-4590-9ea4-10ddfc7c71ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "4873e23f-2313-4383-a3f0-72d405ec1c1a", "value": "02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d496a5-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "c2bc6e5f-f0a3-47ad-a169-5a97d2ff2887", "comment": "Malware payload (Mirai)", "value": "d39f8197f546e735509a01c07af97992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "5bf13ed4-0683-41e2-8463-27f7e01a5547", "comment": "Malware payload (Mirai)", "value": "031a9905b0f81f307d5e6682d7cc35069653dd42a9caae81bcc3ee4cfb74c2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "cc62ea62-8615-46b4-99ac-641d8534809f", "comment": "Malware payload (Mirai)", "value": "a21a0c19a233979058160aaa702e24e0c407b9da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "fe9f683c-f085-46f7-aeb0-b7b586f97220", "comment": "Malware payload (Mirai)", "value": "4a39594d5ad7cd087b62c1ab768f4d7b8d5f48c5f0aad50e14da6c82ad53d33649e966de319f6dd1fe5e3e29212d3ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340058, "uuid": "cb855bfb-1d75-4be4-a28c-74a2a8eca1d9", "value": "T124A40B49D2F1E7DFC018E5301632BE154AF3093638D3269A325DE77E26721994AAF9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340058, "uuid": "8b1272c3-6a91-40fb-8661-8fbe1d76f8af", "value": "6144:ugPCi/WkTnVxG/wEkrkHdo7DUHiZqtv26feFuTXL9cDSO+d0hZZ:ugPCi3x6fiXce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340058, "uuid": "bf186199-eef4-4f85-9143-dba7b1c55eb0", "value": 458928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340058, "uuid": "875e3c7e-5533-46a5-be8e-c8e410d6aae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340058, "uuid": "e7bbdce2-91ad-4584-84af-e9bd74df6ffc", "value": "pid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6232c2-94e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786385495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "12061e6a-0a91-4828-875c-8cdfbb03acf8", "comment": "Malware payload (ConnectWise)", "value": "f90b80b035acae48cad08d8d2bb3ff0b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "175fc3a2-0480-48f7-84c7-45e9c4e8a4d3", "comment": "Malware payload (ConnectWise)", "value": "031dcce29761f42a1b40767b358b18d70e8745b233dd21f6f673b7b45b5a60b4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "fcfe4b1b-bcab-409e-a9b5-8924a65bf155", "comment": "Malware payload (ConnectWise)", "value": "621a3c86c25d1895fd83ce2c0688c2a8070d6d7c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "28b8589b-d69f-4f10-9a64-5d56f01b0493", "comment": "Malware payload (ConnectWise)", "value": "796c25bf6c718ced0de2434d1c367a7d435ca9ea640992ae67651d968f7a39ccec85947bb18aebdd0436ea64fb7d8d85", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "6c4394ae-fa94-47f5-89e4-479dddba424f", "value": "T17A46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "c6e241d8-c2b1-4ade-bc2b-a7b88ec230ec", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "6e7cfa03-387d-4646-9f19-9d40f7eac9ae", "value": "98304:YzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:YhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385495, "uuid": "ec2c2918-2092-4597-bd6d-aecbcbbb011b", "value": 5643248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385495, "uuid": "6d7147d7-2dc7-47a9-8544-42a6ea576088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "e19896a6-da74-47f3-9bb4-5df605d274ea", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059b4abf-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786396704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "64737b99-d58c-4030-9215-e148d00a2acc", "comment": "Malware payload", "value": "c3d2a04288cf52ebf44e0943a82b1ea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "1b4d4f57-39cc-4cf8-9f3b-2ec9a0ac7c85", "comment": "Malware payload", "value": "035e39dddadeeacb1915619a98b30872087f505c9d3cf68a40d738ddcddfde57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "656aa192-dbd7-4eb7-8f25-d71985cc872b", "comment": "Malware payload", "value": "cdfc412824976e66ce3af4cdee1529ece1217472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "7511efcf-0492-40dd-8d6a-f00ef5b1f581", "comment": "Malware payload", "value": "5e689beb675341ec8713e1cdd796f6373dec82337231f19d0867913d4096fcca4a4bcf5a732f1b4654180195ff98cc37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396704, "uuid": "4ade7bd2-e6ec-4260-bb51-c055edb9354b", "value": "T170562BC2E961C25EC6393931DFE5F7D8A3392E3495C0AA8EC9C8F33D08F3155856A961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396704, "uuid": "97ce0745-2ecb-4132-b387-5875adf6dc07", "value": "49152:9GXK1+2HWOVvWJCSPg+2igMCLzwYGQFl9A/igoggggDigoggggoKgMggggsKgMgQ:oa1+22OWCH6zIUnHjEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396704, "uuid": "76e3647f-70b0-4aef-9d7b-a5c4f809ebdb", "value": 6095010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396704, "uuid": "14a0cb17-59c6-4824-8dc1-b11236b23b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396704, "uuid": "cca88734-e767-4fa5-b7e4-42dabcbb8b27", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e01cd8-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "a93f1248-171b-4d5a-9349-3866d17653a9", "comment": "Malware payload (Vidar)", "value": "7f35f37546899c2bcc2f0e97248c925f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "eb95c9e7-a9ad-4107-bf07-9bc26b709cd1", "comment": "Malware payload (Vidar)", "value": "04171247bc9c2c317951debf194b3b80ce37d015131e8c569aaf9d39b810b9f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "62e70a77-1aba-40cd-81c0-641f884765f2", "comment": "Malware payload (Vidar)", "value": "eaa7a74528981bdb4e51b5fada4679a5275b35e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "9ac311b0-637f-4517-9b92-dde26d8fd26c", "comment": "Malware payload (Vidar)", "value": "8e0eb28959934383afb5ecef0239d4eab0c5a740a35ebe06a12e868d7d6c9ea598ad0f912b57b1ca64fad5c4d6c37679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "4a4fe5da-9fe2-4714-a86c-080aba99efa0", "value": "T14942F9D37187E0B8C369C238D7AF56B68267304806266FFF49ECC9543A43212A579278", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "8eec1db4-3edb-4c5e-acdf-13ad2d85062b", "value": "351526ecdd2e2b685a290935bb32a240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "21ac17b2-eccd-4ec2-85ec-035a2315ff5e", "value": "192:OSiJGsCoGIYbISWWFshLwRDiIO484Z5M4M8Z9ViGhhSKQ3VG2s:Ol/GIuILWSLwRnOAC38Z98GDSKQlGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371202, "uuid": "81f16547-3421-4003-8485-a3b15145e871", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371202, "uuid": "c21f472e-e26e-4310-93e9-221b675988ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "924adbf1-19ff-493c-ab74-04b28d849f51", "value": "04171247bc9c2c317951debf194b3b80ce37d015131e8c569aaf9d39b810b9f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce795970-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "3a73c48e-bda7-436b-94bb-4ab2a0e0a88f", "comment": "Malware payload", "value": "7d806e52e4569cef491e6e4a43f9bac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "193df4eb-f2df-4d38-a1d6-a66096a4570a", "comment": "Malware payload", "value": "04173419b3048b03ebd52cd8ac36aad39451de40a728139823d4a97fe85efeb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "55ed3cd3-8d60-4ef3-9094-84ca5bb554fb", "comment": "Malware payload", "value": "d1b2582afc68f4526b4c63ec0b5d8aed01fcbd78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "15a43f80-87e6-474c-ace5-18599d97674b", "comment": "Malware payload", "value": "88f5726fcfaa9bd9ee8ad360d5b26cc08657b6c595e0d7adea891f65395f0f32cd62c80b843f0d65393902936a64fc59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "90409fcf-da9d-40eb-a417-ab50638c993f", "value": "T1ED769B07BCE588F5C09A923189B756A27B75BC090B3127EB2E6067783F327C09D36795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "ba247ec6-b8d7-45a1-89d5-abf7a9711276", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "4a824b0d-7dc7-4b48-8a17-5cea9f209fc1", "value": "49152:a/+Y/ld6OZlYB377Txc80NoReobHkJM8P7b4fPwvaxNzYIl4:al/u9X1E688okNzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373848, "uuid": "b8281126-8817-43be-ae54-f8c97a4d37f1", "value": 7127040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373848, "uuid": "ef10121f-6cd3-4566-a3fb-7da18d580676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "4a91a8d2-39d2-415f-be63-7b1e65c99408", "value": "04173419b3048b03ebd52cd8ac36aad39451de40a728139823d4a97fe85efeb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5779c7d-9462-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "d5aeab39-3cfb-4d64-b2aa-e5f3d60a4e84", "comment": "Malware payload (Mirai)", "value": "ead39e75bf397aed5a6dc076662d2014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "7b533250-5858-4f69-95f0-e394b0565800", "comment": "Malware payload (Mirai)", "value": "04cb291caba794af54a271778636d58817a9056e6cfa6e28ae7389e3cefcfcb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "d97fd3cd-7369-42a6-b288-93f1c0cedeeb", "comment": "Malware payload (Mirai)", "value": "faf3b4e4bdea36c6c7d04a74dbfab3492158df8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "351ee62e-e4ad-4a55-ac24-e083d40bb24d", "comment": "Malware payload (Mirai)", "value": "39de9ba5d54e01bbc1736374af2fba808b1524543ce780bb9ec8f25ebda190a6930f28c7bc31ebb6a480e8234d1f1836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328682, "uuid": "2996cf75-19e3-4e2d-a37b-e31adc1adf98", "value": "T1AD532A55FC819712C6D122BBFB6E428D372A5368D2EF32079E256F1037C796B0E6B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328682, "uuid": "63a95df4-c5bd-45e6-948a-565910e0b0bf", "value": "1536:ltc29GVTKL+IdnbqsUY9uufcQiHWBCt3LEe43uE:ltcxG11utUuufLAtYruE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328682, "uuid": "e8200aa1-4ee8-4a22-9ee1-e122f59997e1", "value": 63600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328682, "uuid": "5e035d95-7b66-44d5-8007-3e7144dd6b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328682, "uuid": "78d70004-41d4-4691-a0c6-b49d6d1a08dd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d99c74-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "555fb3bc-3796-49e8-8106-a02c82c82f6f", "comment": "Malware payload (AgentTesla)", "value": "a8f7de686ac1cbcebe22bf17ef2e85a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "b7c0af6e-62d3-4397-8223-6e8a0e65146c", "comment": "Malware payload (AgentTesla)", "value": "052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "a8c116a2-3b47-43d7-b8e2-517d592211d3", "comment": "Malware payload (AgentTesla)", "value": "b6f1d854a1346fd8b2870a4e64bf865fa55212e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "a3491532-f82f-4abb-b4db-1aff9e48e7e2", "comment": "Malware payload (AgentTesla)", "value": "e1fc2e47e2c46396ad59bb6ccc21dfcd33c485a1d0b3bed4fe62f158c4d37503f3adca8b12f46dd73f13c24031a7c83c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "383a1b58-8b3b-4610-a4f0-7471c93b2900", "value": "T14425F104235A9A42E0E6CBF2BDB0E37033641DDF78E2C29A5FE95FE778293815454792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "935e27ee-6f05-4d98-8c4a-c453849e262e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "103a2ac8-ab01-4f1e-a1cd-a3ea63567c98", "value": "24576:ecCp50zkogy/qk9fq9AZf8caPbwvcZRF0y7C4W8CGzPK2lII8:ecCp5kykeAZf6DMcZIy3CGzPKYII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372760, "uuid": "e2bbb4eb-1460-41e4-8e0e-cba938f4fe82", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372760, "uuid": "bb466ad9-6754-4a9e-a62b-c12b7fdfd791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "7ab09724-bf69-40aa-8b5f-feb46ab7702f", "value": "052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b3976a-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786396845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "2beffe34-1797-4239-9780-b4e693e76ee1", "comment": "Malware payload (Mirai)", "value": "f8bc08ee97ebf8ce6ee5c58c7af370a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "e9dd42c8-017d-4306-af3d-fcd8cdedb087", "comment": "Malware payload (Mirai)", "value": "05466e31a37e9df944f617737551e98f5577c88b650625794fc51e41a9bbdff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "d5f418b9-7e53-4c54-acfe-8075a105f63c", "comment": "Malware payload (Mirai)", "value": "7c59584374f300834ba508a88ad5c0d858b37ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "b517383b-7b6b-4dcf-ba2c-e345d093df06", "comment": "Malware payload (Mirai)", "value": "cccbffe9bc23885d6467cc483d8a9501d5506523679ecc016dbca642942b5d58b688e49d4704008844ca4b84271f8c81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396845, "uuid": "61849e70-5197-4e18-9bd1-d0a1df044379", "value": "T1BC14D81A9F620FFBDCAFDE3702E90A4635CCA50722A53B353674D524F50A94B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396845, "uuid": "e8cd6676-f78f-41db-ac6c-cb12a1209a20", "value": "3072:CeNEKj8iCoQ1W/xGgSnLq2wRIup3uo1+HmCK:3p8h1DgSnpwqY371rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396845, "uuid": "43543326-7023-4f91-98d5-3c69cdbbe5cf", "value": 199620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396845, "uuid": "4a3ee439-3320-40ca-9105-7d10f1866599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396845, "uuid": "43627874-728e-4377-abee-f528d8d316c2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0bb4ae-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1786372266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "b507d834-475b-42a0-bd2b-576833131c1b", "comment": "Malware payload (LummaStealer)", "value": "17a98c2cd387216bdd96ef9574b45658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "a13a5f1a-59d4-4e28-a113-4654505aac4d", "comment": "Malware payload (LummaStealer)", "value": "058721f3334dcc2ea2263ca4fa6bf9ba683e8aca0bbec979c2f206c49c496065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "a69d3073-8035-41fd-ad19-296ca9d138ff", "comment": "Malware payload (LummaStealer)", "value": "1c4730b7346dced03c2db223fc9239eaeb9715f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "bd5d9021-ca6e-4cb0-91cf-fa57e13128ca", "comment": "Malware payload (LummaStealer)", "value": "b127443d7e59f3d7dfa681ce64c888c920f84003a976120c1126b0a11463b2802f9f3095843827f017def7a842f6842b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "8bcffe17-7ed7-4e12-958b-23ae110b3d8e", "value": "T1B2D55B10FEC749F6E903163244AB62AF27386D054B369B97EE447A7DF9772D1183230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "de2a5064-53c7-46d2-b3cd-ec5cabb9107e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "145bb32c-8510-4844-b892-432f5fe5a91f", "value": "24576:pCjgh0J3/gg/Lcd6F+NhBeOPAP5vIlTqHbG/CwBZiTO6XOFXnAU0X8s208Byn7fV:pIgYUNhsZQ0d8kfKYDHB2TdbQJiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372266, "uuid": "61bf14bf-8d93-4ba3-82ae-72d9e64915c0", "value": 2977792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372266, "uuid": "f14187b2-0c6e-489c-be85-ac56dc18a3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "c854758f-16f2-4ace-9f8c-f42d3a52b080", "value": "058721f3334dcc2ea2263ca4fa6bf9ba683e8aca0bbec979c2f206c49c496065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d6dee8-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786367925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "17bcf757-6f08-42ad-abe7-d25929cfa900", "comment": "Malware payload", "value": "3de7ef3fd295442cf5a24e64d86aade2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "dcf62b12-78e6-4bf0-9696-2f0c149d0fcd", "comment": "Malware payload", "value": "05e54a22ea7fb9164767d74f846d225f5dddd2a1c1d21b23bff9b6f359ffd539", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "a9b7b57b-2939-40de-92f8-c595269cccdd", "comment": "Malware payload", "value": "43a4a8a12885c381eeab39c8809965cd34e43ffb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "b3da70f8-7f1b-4269-8495-0a6ab4a0e452", "comment": "Malware payload", "value": "95418642574cac2b62fb8d5c677aef84e6f365474a3e50520318214c20478746e4217b4ae2a721923bb3f87674b76957", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367925, "uuid": "abef1ec6-7733-4b41-99a1-0ce9cb405d5e", "value": "T1E8236C651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367925, "uuid": "21157c40-cb4e-4f3a-bc0c-3619121e9242", "value": "768:AXRWNGxVJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Ulx0cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786367925, "uuid": "c0b8b394-da6c-45bd-888d-b9403798f929", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786367925, "uuid": "cb5e44fc-0148-4ef6-bde4-f2efcac933f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367925, "uuid": "e00a0959-4d7a-4917-80cb-f9f66b76ba3a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b74ac8-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "02b65862-329e-485c-9ead-54e10b1c30f9", "comment": "Malware payload (Vidar)", "value": "16e209cc54bad3ec1096bff195c75991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "93e1b7bb-45f9-46e6-a3fe-6bf2413a9526", "comment": "Malware payload (Vidar)", "value": "06516429ea8e31760bf22e48b5b116fd5e89a062d23daf4e880372984805ec9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "0438f8d7-2059-4f6d-8c7e-f26123b85d50", "comment": "Malware payload (Vidar)", "value": "1271d2de7ec1d4034d9f3a150fc731a93320e3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "97562946-ed3b-4c1b-bfb8-a31faa074d4d", "comment": "Malware payload (Vidar)", "value": "569e0f334bb58a8406317388a343bc9cecedbbfff3af7a2537d219f6c80b979df9dfa170b50d829ea40f95a714a12eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "01fbce69-9729-4960-86be-ce46323aaba0", "value": "T1D782A541E15BAAE4C4F6D3326716166725F87C203231A77B6BDCA73A0E82770E7502ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "62ec28d7-e13d-40f1-b085-da6712647c55", "value": "bb652ddbfc6d78f25974f95364fa638c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "618249f2-6baa-4842-99ff-76b7ca26a716", "value": "384:I4cZKPTs8v//HGDPsBeMx3+X+cz5Nkm8BxlckVCwlcqMy:EZiP7BepUm8BbckVCwlcqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371760, "uuid": "bf698795-3191-409e-bbdc-202d0f387c9e", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371760, "uuid": "e36e1067-ce43-4981-a0ce-993e285d1db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "add001e1-14c5-4e94-ad25-f6718d659141", "value": "06516429ea8e31760bf22e48b5b116fd5e89a062d23daf4e880372984805ec9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d620b1-94f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786391791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "99c1bbb5-fd31-44c1-82f0-822eb8f20859", "comment": "Malware payload (Mirai)", "value": "ce4679f696cc9425d1910c2c01b147bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "951cf940-8349-497f-843b-3950e60d952a", "comment": "Malware payload (Mirai)", "value": "0686b544552fe48cee8b3dca8cd397fd43f066b548c6fb5fb7942a8f3ae487ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "f85e96cf-ae90-4b00-b64c-887de9dd8bc0", "comment": "Malware payload (Mirai)", "value": "bb43f0f9c5c23982bd954399cb4c7479bcc0547a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "11e607bb-afcb-4692-b411-128d3fc17949", "comment": "Malware payload (Mirai)", "value": "fa5a8c8c2e0eba146afda0ed0c90e26979841010c45212e67f13188e1a47cd73c5d8b1eefc06b9fe272a86792743c317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391791, "uuid": "177e530b-15aa-496f-bdd6-e98fcae38df7", "value": "T19E14961A6E228F7EF278C73447B74A34975D23D627E1D684D2ACC1141F6029E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391791, "uuid": "c8366979-647d-43c2-9db6-2aec7baa5fb7", "value": "3072:EsynaW6hmKOBhgB6WfQxsKjFZQkdv/QM/mskXwmw2oIPYn3wHjM2:Es6aW6hmKEC6+QfFGU3sXnfzPY3c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391791, "uuid": "7996d9fb-9bd4-4e56-83cb-0ada22f75daf", "value": 197348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391791, "uuid": "8b1a8e8b-6255-4c5e-9b84-9dc74b6c43b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391791, "uuid": "3c124809-c183-4a67-b621-d921c81646a2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348ccfe5-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "1a6f9d50-a580-427d-84c0-a118bfde5f69", "comment": "Malware payload (Mirai)", "value": "23e8b14fdef46e1ee6ec464b8e696dfe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "b363a3d9-cd83-4c43-ad80-1061817f86a7", "comment": "Malware payload (Mirai)", "value": "06c18b2b230de80ae2f1cc137b228f91ec1973f2096a952cbcec8242ef5cdce8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "4cb79517-9f1c-4d5a-bb36-999c210f6fd1", "comment": "Malware payload (Mirai)", "value": "d12d091f9536bbbe3b06b8c97228293333f8c43a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "452e6514-e0c8-4d67-9dbc-e8a75d2b9aa9", "comment": "Malware payload (Mirai)", "value": "41bd81a241559752a16712744772787eda109970774e903510df6caa3628e7fdf7e6f1d4a23df61db2e647d4c19d6d72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356840, "uuid": "50383a97-c9db-48ec-9992-67a0625fb3f9", "value": "T1E744E80AAF610EFBE8ABDD3712E90B0125CCA54B22A47B357574D914F14E64F1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356840, "uuid": "9a0ed368-a4c4-408c-89ba-4d2e48a97f37", "value": "6144:cHA+6e+eVEavlfEQ3XI+SrZ4liC9eJblqpKXfpyh3zAOs:SAbHcEavlfDHI+SrZ2iC9C5UKX9Os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356840, "uuid": "cbbc34bb-455c-4380-b4f4-1474cfdcd9cf", "value": 262484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356840, "uuid": "4bb37193-d8e0-454d-8bd2-a02bc46b7b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356840, "uuid": "b51e9433-6c72-4a79-82b6-bfdc24c9b699", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f61b58f-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "9c3b01b5-7865-4873-a424-5c9e048becbb", "comment": "Malware payload (Formbook)", "value": "92b960e3f922ccf73c1e8358bb20208a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "6d5bb316-d496-4084-8ab7-dbbe138e8c61", "comment": "Malware payload (Formbook)", "value": "06c9642c64e601c7e4d3ffc38bff632bcb163e5fed8dccfe6a85566289058981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "1e6132bd-4a4a-4615-9db5-b802c990fc98", "comment": "Malware payload (Formbook)", "value": "5775ea7aa9633d31a18202c57f8a13b94eabe9a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "da7df2da-1d6a-4f58-b787-b24717457a0d", "comment": "Malware payload (Formbook)", "value": "f38a146f4243afe2e4781a9d2b17bf9e58349d8c601512958a3255d75fc5427f8bd271ee385564fa8c556c03e4f2bab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "02041124-7968-4b2a-a607-1a68b30e613c", "value": "T1DB3501C0372AA715DE686A708535ED7853A83E257410F9E26EDD3BC7B9AD3018D1CF82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "2d8efb9a-6f8d-43d2-87c6-26ac6c54afc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "28278a3c-fbfe-4793-8b99-f24126b67007", "value": "24576:XqGkEOy4GzBH3wZXZFd9bePDA6qMEBUJppQEOqcXTG0sL:XhUyBH2VSA5ZUJptcXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368589, "uuid": "63893aa1-c652-4941-a1bc-a54e53f35d83", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368589, "uuid": "cfe61d52-97f1-403b-9243-b470bfb45a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "0eaf8526-82e7-4feb-9853-a1d056d6957c", "value": "06c9642c64e601c7e4d3ffc38bff632bcb163e5fed8dccfe6a85566289058981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da216a9-94ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786366358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "80786a0a-eb37-4253-a885-29bd90a15b74", "comment": "Malware payload (Efimer)", "value": "fcb42598e3f3421216a3ca3351fade08", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "356f77c0-472b-4671-b619-11aa37f6df00", "comment": "Malware payload (Efimer)", "value": "06e92e3dfd2818d563c474f074a168bd1a47b1e6c24cef73b088821bc81145c6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "fd822dce-9d44-4175-9171-3b5490296e2c", "comment": "Malware payload (Efimer)", "value": "e989a71404e2865fe6c2e38980811bf149983b73", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "93961595-f2c1-4f95-9073-d0cc6a1eef5c", "comment": "Malware payload (Efimer)", "value": "93a4ba09369ae03189fa56b2261287045dba3f7ca1f944b72b64aad237df81f15ae7b418ea2b304cc20273a91659ed54", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "27a069ab-8d39-40e0-988a-607b6a41a391", "value": "T150E633086EE0218AFDB3917CDDE15450E1FDF8AB1B31C58B872487765D271E09E3AA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "4b66d2c0-af07-497c-8f26-5605971cfb85", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "b2366d10-6c83-4264-80c9-cd041cc6f067", "value": "393216:AMwTUpHmdaHQX80DXMCHWUjRcuI3/PGTAI:AdUpmfX5XMb8GH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366358, "uuid": "c370e00a-e65b-4b2f-8cd8-72653733380d", "value": 14010141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366358, "uuid": "000cd51c-3419-443c-b07c-5cfc9a01bc9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "e40dc838-ff83-449c-856a-b581c5a5ec68", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f148ae0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "49d57f77-aa0d-48d3-85c1-dab3290d930d", "comment": "Malware payload (AgentTesla)", "value": "0f40cc16ea9517a309a2fb636eb2ccf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "9cb60ece-7b6e-4eee-8a13-de739e1a0de5", "comment": "Malware payload (AgentTesla)", "value": "070964628f8a82b5e4f80476803a8f2838a7b5e8f51942679b88cc6c0378efcd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "5cab25e4-f4ee-4805-ba9d-78adcc0fcff2", "comment": "Malware payload (AgentTesla)", "value": "77c73238c36ab251227adecd2471f7417c95f7cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "be378c5b-a106-4d2b-9f5a-5768d95e19d1", "comment": "Malware payload (AgentTesla)", "value": "ebb0cbdce9fa19e4f21a52c0d964be07e58c7b4a005230164abb0ab7de399a411d7ad70c8355bb2adfa9374b5b5d5de4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "e693d5fd-9b98-4f1c-b0eb-27f4fd390635", "value": "T1E72512086647F51BC82913354EE5F5B423AD4ED9A413D2273FDE2EDBBD32B568C80282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "744ecdb6-6951-455f-aab6-e35c2cc8a8bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "974bb3b1-f459-4813-82bd-b032f19c5ae6", "value": "24576:8fXy5EhUo51EGP+1sT/CuODj59sVBpEY:8a5oUo51i1sbCuO/fsnpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371943, "uuid": "25d42628-ba1f-4dc2-bc05-3aa74acf171a", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371943, "uuid": "b8257f05-356f-4ad0-8e66-88c2e4c1eb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "a10a1a9e-0322-433c-86da-461e09069783", "value": "070964628f8a82b5e4f80476803a8f2838a7b5e8f51942679b88cc6c0378efcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52887aad-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "3acc3aaf-609a-41e8-bdeb-df0f56ff83d1", "comment": "Malware payload (AgentTesla)", "value": "a42d761e17a07aff3925b2a3ca47ba87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "0826e0c5-3364-42b7-aea9-08ad59e4e871", "comment": "Malware payload (AgentTesla)", "value": "0732e0d12001262cb9d9a9333c7f8bbfdde8db333287a829a2b80e08ab95795f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "3b152be7-17bf-4aa4-8c3b-12134e48b13d", "comment": "Malware payload (AgentTesla)", "value": "722156c6f1ae4f2cfde62afa6fd164bc525cc52a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "0641ba09-35d5-48d7-bfec-f0b75c9a98d9", "comment": "Malware payload (AgentTesla)", "value": "4f30e70b65214114f83ac7131d4d4d901c9c5d0701ce180c0f2af1dcb099c7ebffa8c5d42236292464884d46d4c995f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "3ab0e8df-f7ea-4ddb-bee1-0c3c94b4e614", "value": "T101252219A516E407C989133559F0F2B4177D8FCA9803CA13ABDC7EEFBA12B519F881C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "ba80db92-cd8f-429b-8c33-ca8d24fa48ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "9a2d6b41-ac5a-44ac-951d-20046d68da5e", "value": "12288:ATtZlJdbEMzxzTVyHnpXaZle5cff5iL8sqrQwBO2LLiz+YzA6CNKqgPhNXtBoSpZ:IjxFYpqwLjkM2LLiz46pfhBtp1KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371922, "uuid": "42c6da55-b2ee-49ce-ba9d-50001e52543a", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371922, "uuid": "0a7c2bc4-c65d-4f8a-a150-da1aa9b5bf27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "018a0643-b03b-4347-900f-628e008337fc", "value": "0732e0d12001262cb9d9a9333c7f8bbfdde8db333287a829a2b80e08ab95795f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e448aad5-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "0a9bbac1-e97c-4f1f-a83f-8e446441abd9", "comment": "Malware payload (RemcosRAT)", "value": "c132eac073a697682624f1497c490171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "e6fa0777-8375-4ad2-8e4c-65db1a6b89f7", "comment": "Malware payload (RemcosRAT)", "value": "07da7e987d4cd53ffb38b5601d29a393073a77892868dea9220c11de5fe95688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "b9d73df3-672f-4b65-aa60-c7e0ac0ef3e1", "comment": "Malware payload (RemcosRAT)", "value": "863b03d8fee936347d593bf3cfcaaa931d549fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "ac43ee58-3cc4-4cb1-a3b5-3a40ad30514e", "comment": "Malware payload (RemcosRAT)", "value": "e54f5f8a790ed3c2a6ae40b257a4264ae431ee4abeaedcb630568590ce50a8f42b4af07598eda2deea2c90ee4a25f878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "9626f7f1-24ae-460e-9421-4516ab004e1b", "value": "T19835F18C3501F49FC853CA364EA4ED74A6646DBA9707C20399D71EEFBA4D9878F140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "d485c243-1580-48c2-b756-fb8cd5a665a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "75d4b084-e3a4-496e-b502-2a777fa52a1e", "value": "24576:h4g5uMnNt+GbqaAa4LmlbnxyQh42VWcoe:OzMnNt+GOxEhxDh42VWco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371308, "uuid": "8fd05c12-9c54-4d8b-ba41-7f1537981304", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371308, "uuid": "956a3744-0cc6-4678-a175-37b13fb8a7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "cbdac0bb-ecfe-47f5-ba1f-09030d372251", "value": "07da7e987d4cd53ffb38b5601d29a393073a77892868dea9220c11de5fe95688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b195e8-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "cd863d2a-7561-4c44-816b-7f6fe48afd6b", "comment": "Malware payload (Vidar)", "value": "83ddfcf91457f53235148588b54da288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "4d72c3b4-70b1-4ddb-b055-e091db7f80c8", "comment": "Malware payload (Vidar)", "value": "07e3a06c0f02a5064c3ea0f0ea5087d74a75ff4bec4ba316852aede75c2671c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "64fd7f31-46b1-489d-8d66-3df8a7cc551d", "comment": "Malware payload (Vidar)", "value": "fe89cd15e22cd4c4e7db930e9be62294f6f547f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "f20f8d9f-05bb-4193-a047-45a6b6428c72", "comment": "Malware payload (Vidar)", "value": "49141e1f5c6654a7a0bd4b64251877f8200dec1e720cb3146dbc010d1597b4c1d9628cd49ec20add7543ff1fde9de181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "cef9c864-4292-4235-8953-977b65fbb01e", "value": "T17E323B9736A0E0FCC22DC53565AB21F27A5130441362E9FF33A589852BC7352F6BDB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "719c63ad-1ae3-423f-8d5b-dbcbebe3e9c4", "value": "e489cd9c73beee1db4c320380f37924e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "a51b0b64-8f59-460b-8655-c80250bded92", "value": "192:OY88F6HsAiKE3cOtcMoSp54E08y9fHprpJFkXho2+jQH3Vqo+r:OYvWs7bvpZ2prrFMh/6Mlqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368436, "uuid": "b1152a8e-a214-421c-9853-4c74ae50b9e5", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368436, "uuid": "88eb54fd-c921-4487-90a6-f0ee2fff9303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "636b7a50-8fdf-4b16-a8b0-f5ab94a1c8f6", "value": "07e3a06c0f02a5064c3ea0f0ea5087d74a75ff4bec4ba316852aede75c2671c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea70f1a1-9468-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786331375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "a79da364-90ff-4ebc-9ab0-bd5eb8b7026b", "comment": "Malware payload", "value": "5ae721088de99dd626fbdae017940a2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "cf29228f-8105-42b0-b3f8-a45d7d9c7425", "comment": "Malware payload", "value": "089cd860e127207b4a797f7ba06ffbff170c899ba79bde86287399b6fee02317", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "c07045ab-b1dd-4d02-a74d-d55290f6d67a", "comment": "Malware payload", "value": "9e2c1d4590a787798dcd90c3c780b2b864f37b59", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "62143202-9c8a-4cfc-b0b6-4bc2c223401d", "comment": "Malware payload", "value": "4ac742f81501139dae142051a3535a82190b7ba69f3e412d4a697088de0b4557e31241c2bc1f7f5b25bc8dc0ffef7823", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331375, "uuid": "ab0f0a47-4966-416f-8e84-dbcce9016784", "value": "T13AB6232BF78069E6E4A8813486C2F37063B2D51AC707C3572B6D12B5FD7E2941F89987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331375, "uuid": "8589c30b-06ae-4507-8427-7e698436875f", "value": "196608:Od5GATq6NYNQEOAgp3qfTWlVEEKwpVa67wLND6Mmh/J+5kL2:65GA2xNQ/rKWlulwpVYZDhmeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786331375, "uuid": "fd6202ce-e052-4b9f-a90e-08609318682e", "value": 10928867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786331375, "uuid": "afe9747f-bf8a-41c0-bbd4-b87b4fa90b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331375, "uuid": "55bcfe82-70b4-4d05-8caa-198654e721a1", "value": "solo.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29eb652d-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "04556175-5806-44a8-a6fd-bd42a84b5904", "comment": "Malware payload (Formbook)", "value": "646179bac70c00f8a1ff4f5c70f09f87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "907578b5-957d-49c1-a27e-aa22b060f07b", "comment": "Malware payload (Formbook)", "value": "08ab8e89dd953a56cb1c443adc124b74edc3def3dc66a2e583b7a6c4ff9389b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "325f842c-55c3-4f4e-9082-7ef086ba3529", "comment": "Malware payload (Formbook)", "value": "efdb0a452deeb79c7f0d3abaa92acce29ae5d0ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "249a47cd-6ec4-4849-93e6-85ba81f8fcb5", "comment": "Malware payload (Formbook)", "value": "a449c4062bfec5aeffc259cfa36427d1894ea30c0b9f64784f431c406e9d2382fd466b57d3d8346235590237092d6ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "cadd0ec0-70d7-42bc-a973-42d61b0a588e", "value": "T17C3501C03B757705EDB85A349939EDB642B92D69B424F8E61EE93B8B746C7005E0CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "5f02e762-796a-41d8-a15a-dc20045df527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "a762fc6a-77f0-4034-b9a9-7699c72b6962", "value": "24576:TSbwLApKvKGbLkT65PKyvQMEIUFe4JBPuAy+:G88pQ/bCpRFeetuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368418, "uuid": "00a0ef65-4a4c-4ce2-a7dd-bfc74f5bf222", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368418, "uuid": "fbe180e1-043a-424c-bd34-36a9b3112bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "66dc454c-8a70-4a15-b898-d0102724501b", "value": "08ab8e89dd953a56cb1c443adc124b74edc3def3dc66a2e583b7a6c4ff9389b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ad81ac-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786370616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "e4c77069-8aae-4625-8d32-405025796dea", "comment": "Malware payload (RemcosRAT)", "value": "a85d5d9bf0ae5c206ad939712433ee73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "966fdc57-eca3-45de-86f7-c9de5a6477f0", "comment": "Malware payload (RemcosRAT)", "value": "08ca84e4ba5b01af8f284ad28c307c2ffb0fcf7c6f6f98b69bc2552ef286d235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "f14fc874-31a0-4a81-b3b2-f41819223cec", "comment": "Malware payload (RemcosRAT)", "value": "3a9fc55909c3b903f193fca48c4a0f0be1d106a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "3e437f0e-0510-4fd4-8700-e235740bb75e", "comment": "Malware payload (RemcosRAT)", "value": "603c4899954a70ce15216d942fb58af96a5f610bd8fdc003324d54b1de2d32bce1d1a2c88452e15bfb580732d3c25d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "1a5fd18f-6e48-4418-91d9-02a76e536e08", "value": "T15165E0122DC76664C7AB5BB8C166049823F0AE0742E5E35E2FDD61EFD9E278DC9050B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "08ea55b3-195e-44fd-98b4-ca170d100d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "5812d05e-ef1f-4a05-a049-dc4dcc0ec39b", "value": "24576:C50jhwH7krKlGwo9usMAPz8C2vNO1Q+m:gewHsgGWxFKQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370616, "uuid": "d9029306-b6da-4359-bee6-023b0800d499", "value": 1528832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370616, "uuid": "feec5fc7-0811-4166-a4b4-a1ca2b5e8f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "e8aa25f2-b228-485f-8b65-0d4680e7a2a4", "value": "08ca84e4ba5b01af8f284ad28c307c2ffb0fcf7c6f6f98b69bc2552ef286d235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8408c9c8-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786369428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "8418553e-12dd-4d1f-a288-6936aa9042fe", "comment": "Malware payload (RemcosRAT)", "value": "de9c9f41a10cc497fb410eb94df61bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "121dc910-392c-4fdc-8290-1793a1e58ab5", "comment": "Malware payload (RemcosRAT)", "value": "08e9ee91c55772b2c30f2ca6d26b9960000f3b08d08bf878d5d95045c93fa7c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "a540a2fa-0e84-4e2f-a6cf-5261b8bffc7d", "comment": "Malware payload (RemcosRAT)", "value": "fd8f0e2ac7433deadde4b7cb990d59f0edd7b855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "845abd10-8767-49e2-a5a1-d5f58e0eedb1", "comment": "Malware payload (RemcosRAT)", "value": "e435617ba621873fe5f406f5ef261f6ed6ce3ff9bef44c3c4c3f870a737a19203be48d603340618117df4c931f137108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "11cfaa01-f929-483e-aa98-cfd74c2185ec", "value": "T1C5150164A74DD406D4214B381DB4E27C0AAD2E9CAA21C3675FDCBFDFB5B27064C493A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "bb550ce1-9149-443f-8b2c-b88d41baba70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "75d6a65c-d44d-4edd-9c78-e1a8716f0a43", "value": "12288:64gBwwZjCrUAJK0fjKDWSQM1nh9bTiO5RQogkU4Wo8YLi1hoNat6NZVXEcOzyO:zUr0fjaLQM1nXTN5yhiOhcq6vV0Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369428, "uuid": "88e8ccd1-1be2-4e23-9957-0d9d589611f6", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369428, "uuid": "99b78aa7-0463-4bab-b1f5-d984517f39db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "f72bda0a-ffea-4431-8858-3eeb551cc318", "value": "08e9ee91c55772b2c30f2ca6d26b9960000f3b08d08bf878d5d95045c93fa7c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91de489e-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "f084d69b-ec47-4905-870d-f634612f46b8", "comment": "Malware payload", "value": "38e7825de04bbc9621156431efbec8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "a04ed16e-9b92-49c0-ba87-9d88ee776139", "comment": "Malware payload", "value": "08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "a29c1739-9735-4a6c-a21f-48723c12bdb3", "comment": "Malware payload", "value": "6b7d86fa064ebd1b4c4d17cc1cbfb5b54bb3e9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "b69571fe-85f8-40b6-a00a-1b6de040761d", "comment": "Malware payload", "value": "16b3119159f426360657bdea6b091071013d1bb3fdf72271d77dcd795fbbb0f3ab3e78466e80746c0652b377a4c528f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "c6f318fe-d0e2-429c-a311-9de42251b8d3", "value": "T145F57C27F7887D3ED46B0B364A37C690983BB7627A128D5767F00D0C8E355942E3EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "88847e2c-f9d8-41ca-a8c9-057c0eb32314", "value": "7c77b89cd344508d2ca812dd1c349c70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "c904dd03-f5d0-40f4-8bc4-e48d6b96cc31", "value": "49152:XPJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvzlzlneJejyw0Fq:BwSi0b67zeCzt0+yO3kSh1wJejyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373747, "uuid": "6e54b13f-908a-4b96-8b1e-1b7bbcb35395", "value": 3491840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373747, "uuid": "72af235b-7c49-4b23-ab14-b91033a65628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "d01fd5fd-0c96-46fb-8053-80bfd91fc77f", "value": "08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7b744f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "8d2a349b-943c-408b-8a53-62b4c3a35178", "comment": "Malware payload (Formbook)", "value": "26254aa8ca84f1737b7f2f28f9079e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "3f5c674d-9a2f-46be-b7ee-81fb6b5c31ec", "comment": "Malware payload (Formbook)", "value": "096c48b0ee06c15d38d34b95feae0c15e21400f793c436edd8e169b119b10436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "add61a93-2c17-437b-955c-b4cf717b68b8", "comment": "Malware payload (Formbook)", "value": "86b23b5e839595174482d9cd437af238c40f22a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "3ec2de2c-be6d-416a-96e7-067ed5ff17da", "comment": "Malware payload (Formbook)", "value": "0329dfa023e854e7141dcecc754921185b4f4bf9ded1114a468e86d268bd0676e6bcbe5360b055151866a16c46862d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "3190e65e-19c9-4acc-9300-2657bc8f37d1", "value": "T1D4351218264DDD06D0A20F798A72D7F81AA42F8CF421D307DFD9BE9BB67B6D12844352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "62398395-14aa-4a70-9eb9-ee6620045e35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "c6252974-9447-4c22-a06b-0abc7c068083", "value": "24576:ma6UwulyXuwM68CL0B0/lQVNIfjsFk+gDe0P3QMzlO7O:ma69ulyewM68g0B6QVNQ3lD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369010, "uuid": "f61a795d-f20b-4210-877f-e57ac88a60c5", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369010, "uuid": "1ada449d-0e41-40b4-8ec5-3ea721535cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "605abe8f-b0e5-4a32-bb6d-cb561819a05d", "value": "096c48b0ee06c15d38d34b95feae0c15e21400f793c436edd8e169b119b10436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572c8ec5-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786372360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "ac9609d1-7e7f-4dd6-9db4-3c307c9cae36", "comment": "Malware payload (a310Logger)", "value": "c1f26136f8be1264bd9ca1b7f81eee0e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "81656eb6-cec1-43c4-9c42-f5df6b64e654", "comment": "Malware payload (a310Logger)", "value": "09a6528de56686a9c7ed4f4d1ed0642e94071b929a8d11a2a0220896f24daa82", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "001790cb-d2dd-4cbb-ad53-51a6cec1893c", "comment": "Malware payload (a310Logger)", "value": "3c7947cfef4219325a93221dc33368f0d72d118f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "5924d801-c7c7-431d-b176-8014fd93b601", "comment": "Malware payload (a310Logger)", "value": "ceda4afed6aec4c262207f9f914d17d46a2acda6cfefb3a352b1718c5154e84c4b39ddf0780f478f747a57f158bfa808", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "74ddaa60-e72c-44ac-a894-46cad685c41f", "value": "T139944A13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F5A35715D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "b7e82fa4-1662-4791-9357-489acbb60333", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "b275ef86-b619-4d42-9839-939aec09c745", "value": "6144:Ee8d1/w5KA81IJ8GpF6nuTmOOUiBUrjIBg58zNCQWFiuSxcbykxCX+D:8jYKkJj6GmZUiqrsJCRpbykxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372360, "uuid": "7e9203a6-c138-4f35-a9cd-b2f3b7d901a6", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372360, "uuid": "3e33678b-d481-490a-adad-255627918d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "2f8266b8-2e3d-485d-8453-64a954f9e3d9", "value": "09a6528de56686a9c7ed4f4d1ed0642e94071b929a8d11a2a0220896f24daa82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a55bc13-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "d89671b6-07fd-43e3-8ac5-a1092884a582", "comment": "Malware payload (Formbook)", "value": "32eb0b440a70875f180b03f1d50cce9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "1b5eb21d-39ef-45eb-875e-5cecca102cfb", "comment": "Malware payload (Formbook)", "value": "09f1444f8922e986eec2b7b0e071e0cfea879a953cd612c4711dfb4b7c5ea744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "47b5d82d-7221-4f0b-b60c-5b3fd210082a", "comment": "Malware payload (Formbook)", "value": "ff25e896f5f25811f0f79ddda7e9efd830904d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "cfeab211-01a3-43cf-9110-0d45ae7c29e9", "comment": "Malware payload (Formbook)", "value": "162e10a09ec0e71d8596ae9df25e593622609764d5630567438a603c8b2499aed32c386dd57151608969d83dd2d2bb38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "76e7bc5a-4cff-4e52-96bf-15707918e555", "value": "T1303502186368DE06C46A237459B4C2780B748E1AFA11D3179FE8BEEF7DBB7124C19247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "8e2e21d7-9eb0-4081-b698-72d4872cca83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "cd685147-48c5-44c3-9367-46c5159763df", "value": "24576:5ATyQgQ0+puNBG1uL8mdyHzOSLgOqOqADisuANvV0LVX:5APgQ0+puP/83vqOqA+sfNN0LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369359, "uuid": "68faf7a3-3ea9-4e47-bff1-7a4c445f6c38", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369359, "uuid": "41bb24cd-800f-468c-889f-51b12434d540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "6bfe5208-5c9a-469c-b03a-38be71575c88", "value": "09f1444f8922e986eec2b7b0e071e0cfea879a953cd612c4711dfb4b7c5ea744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fff0488-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mallox)", "timestamp": 1786373556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "132bea31-281b-4fbe-9343-cfa4f87aab22", "comment": "Malware payload (Mallox)", "value": "fc39b8632c13702c93a374c35ca0ff69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "a31d722c-874c-46d4-aba5-0fe38e771f41", "comment": "Malware payload (Mallox)", "value": "0a26eab06e82c211b5e8c44599e481bc9a8360ca75e5bf3aa1540d1b075643f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "4af5492a-9cb1-47e9-a47c-412d6efea7fc", "comment": "Malware payload (Mallox)", "value": "f3534ffcd3fc8cca3ad8ebc1e15d22eed4ada415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "a4af561d-e667-442b-b728-b87a07a26a5c", "comment": "Malware payload (Mallox)", "value": "14f9ab011486f45e6021b19e9902731d210efa7afaf74f629ecbd3ac6193c0ebb8dbbbb70ed7419545614083823015ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "923dcdfe-5d89-423e-ba5c-61aac36bdac3", "value": "T125247C0675D22EBCC416C07492479922997678080331DDFB23EA6A343FABDE29F3B715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "dd079ab5-c343-47ce-9f53-f3ba6e605017", "value": "304f13e4e8ec4ee68e46bda734dfd40d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "f410e575-6262-4ed6-a0d2-ab4bbc80fd41", "value": "6144:/4gS/pUMV+m8+AvBWro3sCilsiNKUEza/:gFV+mivY4iVNKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373556, "uuid": "1dea8eaa-7a23-4ea7-89a7-51fd7822b59d", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373556, "uuid": "f70307d6-8bf5-4210-987a-802af7f416d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "f36fd92a-a476-4025-8f87-aa0ff4488ba0", "value": "0a26eab06e82c211b5e8c44599e481bc9a8360ca75e5bf3aa1540d1b075643f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b3501d-944f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786320353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "d7b84786-e1a8-4773-95b0-e180e8876cba", "comment": "Malware payload", "value": "9380b0cef1b1af5e53f4bae55392404e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "b5fdfd24-a4bc-4c9b-ad9b-441fee7b1ac4", "comment": "Malware payload", "value": "0a3e9686877a670b85b55c614b53decbdc97988605ac1c2fdcf2b56e25e080c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "8e1eaa58-df49-4569-8129-29051c652a10", "comment": "Malware payload", "value": "f2a34ff72fa8f13ca322cadc9a1f2e36dfb5de54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "b28ee658-84cd-47fd-af5b-634fe68ab9a1", "comment": "Malware payload", "value": "214b531525893575463e6c5a3e293b4685d29a37b9d68a3151bb6181c9f50e0f43fd3e8a2a0dbbedcdcf5a11015d40ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "095cc5e4-a261-41a0-a5d8-edd1e726dfe4", "value": "T19F857E57F2B400B9D4A7C17989471907EBB278061774E7DF17A08AAA6F23FE1167E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "aeaaebda-94c3-4008-804e-9f927a457bf0", "value": "bcb151cdaa5a26bccf82eb41d5b5df24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "74f68789-525d-4d48-b794-237064ea35d6", "value": "24576:p1nCWu7ciCJKB0YETD3nUKbewsTqC6Yu4RZUmDXQ6Gex7gYbdgNgIaH7h+skNIBO:p1Hu8RYEf3nUzu/a1DXMgIaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786320353, "uuid": "78d7a29a-163c-40fc-a472-6551de3a7560", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786320353, "uuid": "f383df77-09b8-4938-ae67-07e00cbc610b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "eaa3bd2b-fd8f-41a3-96be-5d8aed72f657", "value": "PFTZZN.478.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0291624c-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "cff80379-6a13-47ee-a286-c14b2d747f26", "comment": "Malware payload (Formbook)", "value": "37d4d53b7fa928f4a3f000002ce9f734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "832ed743-4fa9-47c7-903c-2d912e02085f", "comment": "Malware payload (Formbook)", "value": "0a86c64e79af15ff094baad609d9651eb51e382c817498d44b2df82005fd3f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "8a9be149-4b26-4858-96a2-d0f59c1e16fa", "comment": "Malware payload (Formbook)", "value": "708c0fbe63dd5f133ed5e1feccc0574eff33a6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "53d9558b-76a5-459c-9168-03b1e898122d", "comment": "Malware payload (Formbook)", "value": "23b21618620a4203a79b96a389be240473db036103d53a56c1addbfb2ceaa7f677939e219c48b3051c28e3122c17e337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "fb940e74-1150-4968-b087-98e6b2756893", "value": "T13B3512B06AADC821C8E247754A91E33842F86D85E920CB135FECFDE73976B076850B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "3c01ed07-a474-49ea-828e-779bd126b945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "b96dae63-7cce-4c06-a272-decf1109eb56", "value": "24576:TTHp4rAVMxtSFSnaf/8f49GaY+jAmzPJZHHS5w:fHp4rlxIFSZoGaYyAmvHHSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370500, "uuid": "b727926c-366a-4436-a619-e6bf47cb6213", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370500, "uuid": "bfc4813a-8f1d-4555-bbc4-117ef4670ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "c851adc4-d277-47ba-be49-53a4403c030c", "value": "0a86c64e79af15ff094baad609d9651eb51e382c817498d44b2df82005fd3f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf22f59-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "cb7bbbb6-7f3b-4bae-b1c9-b1edfd1a9d07", "comment": "Malware payload (Formbook)", "value": "be83468521645c57f267a93673c7b090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "cd5c3b2a-eefe-4aba-89cf-804083f65c10", "comment": "Malware payload (Formbook)", "value": "0aa3ae39f4a3f4a840b6666201ddfe6bd288c0d33ddfb0a12d8de7e929b0e7b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "1303dd86-38fa-4d62-b8a0-ca081153c3b8", "comment": "Malware payload (Formbook)", "value": "358c790c4b86fcef8265a8fdb733ce86f941e058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "65ae48ec-e084-4637-9d19-f3039a22d902", "comment": "Malware payload (Formbook)", "value": "1abdb7776fe9545062cbdd7b2987bcd0c0c7585880ba266b69ae9cebe38d2d0e3f9661336f018b1433a641ba9b761175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "43976c92-37e3-46b1-8008-fe77aa69d91c", "value": "T1542512542AD9CB95E0A647B81AB2E37107757C1AF620D31ACEFC3CEF3961B00256476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "9869e31d-3de8-4818-9aef-c7f9c038a7d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "84b44243-8a56-4766-bffc-56da8acdc101", "value": "24576:kpYwJcZrdau288i2MPYCgjMLSFQmbkke4h4dPFdNQ4:qYwJY28528ngjMLDmIv4ePFdNQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368742, "uuid": "76308b19-7087-4caa-9c83-f86b39da265d", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368742, "uuid": "c0acf082-7efa-45af-820f-63234b3e3408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "495f6f37-7557-4b03-968f-ecb31630c745", "value": "0aa3ae39f4a3f4a840b6666201ddfe6bd288c0d33ddfb0a12d8de7e929b0e7b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c971b290-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "aee1d4b5-75d9-4a7b-8fd2-30937aca3ff8", "comment": "Malware payload (Formbook)", "value": "3a5d6bffa0cc6f813a4cb892abef72da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "99e09f8a-2933-4e2d-bc52-39a0e9a368c5", "comment": "Malware payload (Formbook)", "value": "0acf3ab0676daef69a718b8d7d3e8888ca5d4d3d5e4c7963f72291838f61f05e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "e2b77708-b867-4be7-9bb4-1d1ab08de796", "comment": "Malware payload (Formbook)", "value": "6adc4ec934e15e08d3945fb66b0a6a76a250ec11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "59b38483-a173-4bfc-9ae4-05bd9746cad0", "comment": "Malware payload (Formbook)", "value": "5946370c13d2d3974a921dc217b47875401cb9231d557e24c417b82a890456460e6ca696250f4a0b91ffe08819794167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "ff3ddf35-16dc-46b1-aa1b-74358989204a", "value": "T1342522A863A6DA16CBCB47B91970C338037D9F9DD421EB078DD8ECD7F52A3016A69740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "10b8e797-bef3-4a9c-b550-4130b8ea7591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "113ec6d8-804b-48c4-a760-56608de63ed0", "value": "24576:/j/Og3bpWj9wqH5LUMGuTZX2iOpEDqh+N1yT2qCoI:rPrwjtSMGuTZBOpEDZvyT2q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372122, "uuid": "468607ed-8706-4b35-8ebf-f45d0ce82695", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372122, "uuid": "c2cb6986-4870-4cf1-b37f-fc26f6be4efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "a17ed945-7975-4f53-a28d-c30b68146717", "value": "0acf3ab0676daef69a718b8d7d3e8888ca5d4d3d5e4c7963f72291838f61f05e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceef905-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "45856721-0271-4a2c-9b4b-c92dfdad893a", "comment": "Malware payload (Formbook)", "value": "95e5dc046bf82e353f23fddf0a3da303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "b5a4681a-5049-4e87-ae8b-a628f8138cdb", "comment": "Malware payload (Formbook)", "value": "0ad8902d47dbd13f6395d2c6b86d37dfebf166098f8ca6c1aee5d948db82d168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "a35ae4e8-f8b4-42f7-b955-e70c7c77f3bb", "comment": "Malware payload (Formbook)", "value": "511528177c62e3712d6dcebb2e349da9ec23cf7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "26091962-360f-4de2-9206-1072b7351976", "comment": "Malware payload (Formbook)", "value": "5cad24e728e7c15ac5a7cce06a5158731010b7a6b5d469cb9f522a4b9501709b35347e36cab016fef643f12a68d5517b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "f9659969-bf59-482e-861f-6a0793a5fde5", "value": "T12B2522496788E907C952633D0EB2F3B591EC2CEDA801E3675FE9BEAF3E369450D04152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "5999a6b1-e4f2-4e62-a5d5-555a314ebe4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "6dc2a124-5de3-4566-bee1-b418e1a3664b", "value": "24576:W+ZSQeqUqPhDU2a+AZxpCg579MZPAvbMzk9d:WySbWPhDUFXeZPjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371403, "uuid": "0ad06fde-fb85-4746-bd5b-97cf3736f4c3", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371403, "uuid": "7e8709a5-d744-4df6-81a4-adbe7ddc6875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "aa2f0627-e290-489b-b88b-034b5d168383", "value": "0ad8902d47dbd13f6395d2c6b86d37dfebf166098f8ca6c1aee5d948db82d168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75294580-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "fbab27a5-1b1d-4fa3-a622-92ce4c58fb81", "comment": "Malware payload (Mirai)", "value": "00402cc9da1dfe2b811de1f8c0706c1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "a000f78b-ea8a-4769-af08-52ef748eb550", "comment": "Malware payload (Mirai)", "value": "0b4ca73e31710a1798b96a479127df657bab65481885aa9554371771b711bd0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "29024081-5727-4581-afc2-7d5943f37301", "comment": "Malware payload (Mirai)", "value": "79260401814bd4675e773407f8ea2ea274cf862c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "5708756e-9285-4c94-b59a-ad105b39d2be", "comment": "Malware payload (Mirai)", "value": "bea741bddee03edaa9f66869a92ce16d9f3cc65e5fd36cf043d2abd8231ba9366dde5507884fd688e9a97731251d829c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340198, "uuid": "c1f8db2c-0e13-4d2d-8f86-3b2cb98726fe", "value": "T16B842B48A3F0D3DAD1A9ED70233A3F1A9BA6062630977546211FFA6313B21750ADDDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340198, "uuid": "1db48599-5b68-4cfe-8256-a169e959b7b8", "value": "6144:ddHOWACKtuz96hwOlu1dd7hwyHpkVocCXdXmoN:ddHOJtK96dsF7hwyJyocIXmoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340198, "uuid": "e09a52cd-e3ea-4d25-b979-bbb7df18b73d", "value": 407824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340198, "uuid": "45fd770f-ed73-4531-bfe5-076218032588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340198, "uuid": "d703e96d-a7cf-4e13-84f9-257bc0ba154c", "value": "pid.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79581b30-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786340205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "5ad60167-d726-435d-b030-ad74409099f2", "comment": "Malware payload", "value": "9ac966487ee66ea93b5b5c749c6c8777", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "9fbb295b-5b2f-40ef-b9e5-95ab75ef9cfb", "comment": "Malware payload", "value": "0bab7521b5930f90cb3c693cc71592e369b654a417c166b60971e7177c306a96", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "ed15add3-9a51-40bb-a5bb-1e5b9cc0acf9", "comment": "Malware payload", "value": "1c4eb2a84222ef824434e7ad87766e2472658f84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "8b877550-d57a-4ed9-93e9-2948af287544", "comment": "Malware payload", "value": "7fdb7d2539a6c335b4dce80559de145636df660158c5b9d100317fe546776b423ea79d1fcf3019c12e6c1b06e9913e57", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340205, "uuid": "3f490b39-d376-49d9-a994-d859a4de239b", "value": "T1A501CCE5B828D2B07D4E9D2AD5DA0B8584410C3B11A53ED4512A6DF6861C608E10DAB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340205, "uuid": "c8f90b02-45f3-4141-84de-c5d26f76449e", "value": "12:sTlohbtQAr1tX0JW2F/hKypU+/jEpN8uJpN8uepN8uqFsftux5dyYpM80v:sTlUbSAhSZFpU+7EpbJpbepbqYux5MYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340205, "uuid": "2e01ca82-053b-4132-bacb-a538ef140219", "value": 851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340205, "uuid": "2fabf2db-3357-47bb-ac10-07fbf72d90c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340205, "uuid": "4fdb1440-14a8-44dd-b3f2-23cc48d7a662", "value": "run_adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1ec67b-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "c3948cf3-d55a-4586-874a-e20f1b92fbeb", "comment": "Malware payload (Formbook)", "value": "068ec306c716a07d090962917bacb7d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "354bcdab-6059-497c-ac7b-e4da548cd9f3", "comment": "Malware payload (Formbook)", "value": "0c2a64ea107f2062205b156046bc4d32faaef572f717c7964f2cb35a1ae6809e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "24866e15-9b11-44ac-b696-a3f229767e76", "comment": "Malware payload (Formbook)", "value": "f89ec91e12d8273c0cde65813828da1317b90451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "21497a21-ebd7-45af-8200-2b01971f92ab", "comment": "Malware payload (Formbook)", "value": "a4629cbbc5903265da867752cd838e160e6ed41d1a5e880abe24b620516ad82f35e4e07e1e5ad5eb80d7e2d6a9838c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "bb628541-0178-45b6-85df-85b5b1022876", "value": "T161350248320ADD06C6D25FB11E70E3B486B84E94E910F313CEE6BDDBB97A2963D552D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "8226afa0-5b09-4983-b0cf-7aee28c7646e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "5febc3a5-4651-40a9-8006-cff545552081", "value": "24576:C7R6pFxTm4pNd+uBrGRGaookTGY2s6kD+LzpfMtG:ClibTmcN04rGHook96kqLzpUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370868, "uuid": "0246620f-fa1e-4664-bf6e-fdc6223bb538", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370868, "uuid": "a88d9baa-a367-44a9-b780-8e5b3126d657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "12b2e39d-07a2-4a97-b25a-2c5092848132", "value": "0c2a64ea107f2062205b156046bc4d32faaef572f717c7964f2cb35a1ae6809e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3b7949-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "4de61ebb-14ca-4bdf-b7c0-0e9a2c8bab7b", "comment": "Malware payload (RemcosRAT)", "value": "d93ca0f00ebb5449d0e94712f75470e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "13a63e7c-d03a-4313-b667-ed011f8fd09e", "comment": "Malware payload (RemcosRAT)", "value": "0c3a63f8f91965db6755ea623fe109ee291dbba63dda3022b1a22a9640bccee9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "4f4a4f33-c7ed-42b0-9ce9-b02140cd0008", "comment": "Malware payload (RemcosRAT)", "value": "7d1e582d062fd54eb3b9815ca45b9f0d7f4760f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "7b402ace-9e51-4093-9f5e-469092e66ed8", "comment": "Malware payload (RemcosRAT)", "value": "ceb64b70cc5a717f731b5890bc905f44f3326fc422940f6da426819e9b0ffc61f78109421b1b3c156a5b9f37075e6c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "163caf87-1506-4d56-8ef0-82eb8b0d55a1", "value": "T17CF412A427A8C751E0F617F11AB6E37243707D5EAA15D31A8EEEADCFB831B005618743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "5ca15376-0022-4393-8712-e4960f43b91d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "0f35971f-6553-4b93-9440-c1401239ade4", "value": "12288:t8/HiNbnqjOwqTcYUEn+Sj1FV9f/0mWIAieTD9QsQxYfu2FTl8Y+8gzhLc4:tGcn8Ow0cc1FV9f/0MAikD+s3Gcb+8gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368857, "uuid": "b929a280-bff8-4db6-b326-02e7b2f0af54", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368857, "uuid": "7be212ed-4008-4d18-932a-089af4a68cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "bb2cb79d-2a06-46d8-bd03-4d619a086773", "value": "0c3a63f8f91965db6755ea623fe109ee291dbba63dda3022b1a22a9640bccee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebe7484-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "890392cd-4f4a-4ea0-807f-0867e72257d7", "comment": "Malware payload (Vidar)", "value": "3989f639bc6cc32c1f95fa1dbdd4825e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "93be2295-4f06-4444-93d0-e51fc2657333", "comment": "Malware payload (Vidar)", "value": "0c725e05e60ba16ff566d9201510a6bcfdadede5baeaebfebacd9219f2abe89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "1dc8fb33-f843-4dd3-b925-05c5ac771f11", "comment": "Malware payload (Vidar)", "value": "6403217a69e4eeb9600dcb526fb7fc879afb0eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "1c0ed210-b2f9-4353-b195-aa017ef9811c", "comment": "Malware payload (Vidar)", "value": "d8c691e115bdfa83922515445584ed73acc300394f6392ed9dc4ff760f4ac203ff1250d91feaec5f61649a49352a5c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "297ef240-5585-4c6f-ad8d-b3f1bfe0a9ff", "value": "T18652C75672EA60B9C1FCC3BDD94A16F7CF163092230E1EFF05EE81A467C2151A9A8B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "d27f9271-1a7d-45b3-a995-239cfb936b84", "value": "4b0c36d710a9f321af707a3125adb015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "04e055fa-57ff-42ac-af96-a6def50d20ff", "value": "384:QPmpWl8QonKQcxeVlqGXTAlSCCdMuUGmPlw2:9WCUwlqGXMlSCCMLdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371245, "uuid": "b6411bec-5653-40f0-a4dc-13e6f5911cab", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371245, "uuid": "5ef34dc1-9c9c-4517-8903-60630b30a692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "2781de04-9922-4e80-95d7-a4f2c5c7c0ea", "value": "0c725e05e60ba16ff566d9201510a6bcfdadede5baeaebfebacd9219f2abe89d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5dbc36-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AndyDesk)", "timestamp": 1786371857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "12ea1ff9-b83a-49ee-af57-9ccef2385851", "comment": "Malware payload (AndyDesk)", "value": "b17611e8bdfaa73ec4c1f3e768ef3385", "object_relation": "md5", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "1beda37f-67b2-47d2-827e-d55199380652", "comment": "Malware payload (AndyDesk)", "value": "0c80befb0b31b46f1f0a030af4aef3056806e474eafa8796220056406947bc13", "object_relation": "sha256", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "38eb30e6-89b2-4154-a753-6bcb344daf13", "comment": "Malware payload (AndyDesk)", "value": "9a6dcdeffa448bbcef1f2773c7a3d990ebcecf37", "object_relation": "sha1", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "0bd6b08d-ae6a-4d61-ab0b-d4115d627104", "comment": "Malware payload (AndyDesk)", "value": "76bbc5d96a901d5dac4c7955966725d6555b6edcbfc122012016656a8b58d55cf9577f2ea5c49a4b16032df702194b9d", "object_relation": "sha3-384", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "573cca96-7ff2-43d7-a81b-b4a9b6e8a85b", "value": "T1BFD48B10B102E2B1D9021671C893EFF96525AECBD62D84CF67D9FF14BA722D2D01E24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "eb5533c6-4174-491d-94b4-78e79052e3cb", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "9776e714-3d02-4bb3-aad0-5d4ac3790a5a", "value": "12288:gANwRo+mv8QD4+0V16cSI5m/eWzUQj89lb6x9xIerCbR:gAT8QE+kiam/eWzUU66hIeraR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371857, "uuid": "d82d8341-6b02-405c-a6d2-3ab388308ff0", "value": 612296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371857, "uuid": "3d773bf3-d222-41d4-9b1f-74e5d6fb872a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "4cb614ca-491c-4824-b394-593ed8b264a1", "value": "0c80befb0b31b46f1f0a030af4aef3056806e474eafa8796220056406947bc13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b32734-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "31c1eae2-12d5-4d1d-89b8-0b67fedc85ac", "comment": "Malware payload (Prometei)", "value": "60afd5c2a771fd8fc1746717e39bcdbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "8d6de918-21ca-452a-9706-d27cfbd17072", "comment": "Malware payload (Prometei)", "value": "0ca3a4c2800f9454cdcbb8398a7ec97b00f90f4234c7c5e48e206a8352d86750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "5417ebce-4381-45b0-ba47-a088aa47e737", "comment": "Malware payload (Prometei)", "value": "96bb1c2a720716a05f876ef280b8d904c53396aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "38b7b7c9-b1db-4f8d-b790-b836352c7c9e", "comment": "Malware payload (Prometei)", "value": "c5ebb126ddd97097589d1dc8c9bf6b0490c73effe53a3e321a616ffc97ae8b1e535320c1814f39f70f543fe0c50fb6d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327710, "uuid": "7f9beb94-0701-4a74-b24d-ee06a1571552", "value": "T1968533FA241A6056C502F8A737BA36E2960D6CB52DDCE09FD4CED4A61A3D5EE4F103C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327710, "uuid": "3cc4b76b-5d68-4137-9319-42373e82b4c2", "value": "24576:U5EPwlAml7uAKqU0zhb20eH5YEdA85xYsP3zRqU9MNvYbvNspKu5Xfuwd3vjMxmS:kxOmVyn0k5YEdA852Ez0WKgNsJmwlumS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327710, "uuid": "4f8947cf-1233-4adf-91de-68987042093f", "value": 1750956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327710, "uuid": "106e21c2-6039-4a83-b584-b049c19098b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327710, "uuid": "95676671-ab0b-4043-8030-45e227dfca0e", "value": "0ca3a4c2800f9454cdcbb8398a7ec97b00f90f4234c7c5e48e206a8352d86750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1a9b89-9469-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786331750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "3260e7a5-4532-4c46-aa24-6376f61ac184", "comment": "Malware payload (Gafgyt)", "value": "38ca7c8dd35148f1ecbb2c3714c62fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "3a4e1e87-f442-4c59-aace-95167efca83d", "comment": "Malware payload (Gafgyt)", "value": "0cbf6f10c9a39d628bb5c0a3810f25d2f58b37a4351045ab200c62154d03734e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "19c88d13-f54f-4396-9f92-8ca082c38edf", "comment": "Malware payload (Gafgyt)", "value": "60d150d7ce20e5c5a62b0ea242f73c748daeef46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "b9e23e74-ca94-4a0d-9f5b-bde1a50e0a4c", "comment": "Malware payload (Gafgyt)", "value": "b313d941540b30019451a106b6421ea881b3300cc6d79c9bf0fa8a20d3f8b0cbd5d1e57c043c5274faeaf1d89ad8562b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331750, "uuid": "9c6233a0-d480-40d5-ae9d-fea043935a32", "value": "T151E4E80B6E328F7DF67587314BF70A249BAD23C627E1C581D1ADD5141F2028E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331750, "uuid": "588b4833-ade1-4f34-aea3-e04566db7f7e", "value": "6144:z2S/dEms5U2a9B4msqKpv+/ogsad0CHWXCFU/R2DonnG4YgojWDFae7fuBrUR47M:zH/Z1PGa/E8fTi/SziqnO0cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786331750, "uuid": "0997f849-5c78-46c6-820f-d86718c9c87f", "value": 672128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786331750, "uuid": "2ce8e058-8010-4d00-987b-229a513009b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331750, "uuid": "b5217e62-bf91-49a6-857b-065e20d42b86", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260ab583-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786370989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "0cb7ba9b-492a-4370-9201-055f194dcb11", "comment": "Malware payload (PhantomStealer)", "value": "29c45450d73461612b690eaa9102765c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "351d6671-9e05-4f41-aa79-7a021e68eaa8", "comment": "Malware payload (PhantomStealer)", "value": "0d1990eb86358e8c0e10407d22b29fe99eaabe99f8a2fbd0885eba5449bed6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "3afa5d19-5d9f-4411-b486-f8a601ed1c37", "comment": "Malware payload (PhantomStealer)", "value": "cb4d09a29bf6739a2c39afb66cff0344e8db3681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "7fa186c3-6447-4eb2-a650-2bd66c05e5bd", "comment": "Malware payload (PhantomStealer)", "value": "ee34d669c374b9dc7908ae640d37f3ef749e4f5ebe3ee1b5a5e898d7869d0751c1f4f8afadd46b7d200f1bbfa4acaa83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "aaf05c59-352e-4388-a69a-ca98aca97399", "value": "T15E75229C236BC807C6D36EB00D20E37955B95D84A801E633CFF6BD6BB97A2966C052D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "23916eb0-6ecd-46d7-b153-0c2d4960b622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "60090a1d-81e9-4497-b9a5-ee769e368caa", "value": "49152:MtimRD2GJQ1ZqLDgAff6hXIvbcBB1eGxW+b:MtimRfiqLDgi6h4vw1e8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370989, "uuid": "50bd4cf5-fbbe-4399-8846-6795c9564082", "value": 1637888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370989, "uuid": "77453a00-d044-4995-aefe-a370d70e57ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "6c7b49da-7e60-452a-bf1e-434960fa6987", "value": "0d1990eb86358e8c0e10407d22b29fe99eaabe99f8a2fbd0885eba5449bed6ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24345c87-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "20162e17-5316-42af-a12d-434a0961f9d4", "comment": "Malware payload", "value": "0c5a4ef35ee89173c6a0b5cc09d36cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "97f96bbd-c483-472b-8595-2cb8834dd266", "comment": "Malware payload", "value": "0d65e4a99cabc0eec5fa2ddadc32ab2cfe0caf5fe5510e059196128753929855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "1591f114-2647-4205-b3ca-4a887e112d5e", "comment": "Malware payload", "value": "2bc3fa1f90c3a8536157b38629fc353ea43019e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "4f6c5064-bbf1-4874-9d7c-aa3b01442897", "comment": "Malware payload", "value": "ec1cea8232d5001d109418f6c8a3339c82fea9125b40654c4ac8c7cf3985dca4fa2b10a1393fb9eb27b767aaa39fae77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "f2e1d8f0-6a6a-49a2-8790-42f9b933fa3d", "value": "T126F612236349563DD02986755672E21F383F6D306ED28D0ED6FC3478FBB62B0293A646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "1b633ea1-ea23-42c1-bae0-9378ef60ee00", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "02f3fef5-3cb4-42bb-8788-e0e3904645b9", "value": "196608:FuNY1k10RqkdY/dbum2gBeJUsQQ6Eitv2VBeMe7Bw/a:F/1k1Iqkd2y1mIeMeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372704, "uuid": "cc479dd2-495c-482f-a872-9fcace144b25", "value": 16133173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372704, "uuid": "f2bd199e-a04c-4023-a73f-eaea9be52bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "d8c154c2-c88c-4aa5-ae8f-7ebcbfe5a940", "value": "0d65e4a99cabc0eec5fa2ddadc32ab2cfe0caf5fe5510e059196128753929855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725b92f3-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "6126ddf6-fe24-4613-9975-88b0b534716a", "comment": "Malware payload", "value": "df87e4a4892830d2e592654b28914cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "033365e4-58cb-417e-b67e-39ce8f3279c0", "comment": "Malware payload", "value": "0d6d527e4ae081dae608f12be1d2a911c6d2305db00e3d2f7ddcc3651ab8cd56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "164c799b-3a0c-4422-9aca-d8e32dc065f7", "comment": "Malware payload", "value": "c14ac4405d913b144ef57b51a2a1dbfc58bf6e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "48bf4eb6-58a9-45a4-95ec-47e51b8cf104", "comment": "Malware payload", "value": "5e4072babb255f5d47569edfcf44de9f1bf29ae4baf583b7433eceabeb479241f3f6cad60fa2e75085392190027003ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "0b42e6ed-ec44-4fad-b3d1-565535eda3ed", "value": "T1E3622AD2F0A366EDD078C239CA9F13B7D579305827391B7F5BDCC2582D813202A98799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "a0f9f27f-e8a4-4d32-b8b5-e32d3d814ed2", "value": "52d71acbb2709ed0e128fc85766390ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "0ecd3c20-954b-474e-a6d7-b1dd0dec0027", "value": "384:9QgfWzwIV9ZTN40YKCIcEAtKcupfY8lwy:zfWfTPTAt4f/wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368540, "uuid": "24c19f0f-4a55-45f1-917b-d3635cec5ba5", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368540, "uuid": "704549f5-9b09-4bfa-9a39-62cfe90df1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "9e116e8a-9b31-42ba-8f0c-7279163c2ff9", "value": "0d6d527e4ae081dae608f12be1d2a911c6d2305db00e3d2f7ddcc3651ab8cd56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9343e7-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "c7cbb8de-a18c-43c3-bf30-512aed5e4b2c", "comment": "Malware payload (Vidar)", "value": "21f555dda8b7b316cee879a5f2556203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "e8ab5cf5-fd79-4d60-b05c-6e1be83a5d92", "comment": "Malware payload (Vidar)", "value": "0d94ac87482cf0b01ab4bd86931d53849b04b39dfbfa482f872bc2327bae7a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "86f3cf7a-80e3-4bd6-86b8-584e7ee90a0b", "comment": "Malware payload (Vidar)", "value": "e6c1dccc38a472d36e90b18535aac8a4db50cfc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "50295fd5-9812-4cec-a02c-12dfc570a491", "comment": "Malware payload (Vidar)", "value": "c88d9e5e12fdfa9fc5a45b4b533c1fa339735badf0a55fe96afa8ebf30e454c99b1f2171028769502cc20487c388491c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "e02ae2c1-2465-4fa7-811c-514fcad1e27c", "value": "T1375209C731E3A1AED1A8C378CA6E15FB4A5A30C90B195FFF41DC859835C25117A7CBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "bd55619f-84a4-4b4f-a399-af79fb828b4a", "value": "cf623daeb316fdd052c715e1828e1b00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "d142439a-da2f-4f89-a2ef-aebb1820f152", "value": "192:OH0RXdoF8xrOP8NH2zbvwd5ZqJTqxv800WctdIMSkE0boWu3VgIuF:O0XCF6Ozbv0qJHZtdVfoXlgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371164, "uuid": "55edd2c9-8867-436a-9100-bd68b3f6fc76", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371164, "uuid": "f97036cb-da3c-4883-9b60-4679b7f8a853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "585b5668-6cf1-47d1-b114-15f51a7d720e", "value": "0d94ac87482cf0b01ab4bd86931d53849b04b39dfbfa482f872bc2327bae7a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc33744-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786374139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "683e7074-7f08-4914-9f2b-c0488a096032", "comment": "Malware payload (MassLogger)", "value": "5c86a12bd42c78cf32a43c4731c2b431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "09f44184-9315-4412-8697-5107744541d3", "comment": "Malware payload (MassLogger)", "value": "0da4925cc323464f2f002ce18116856a24e065fd0bd32acf9eb5494876cf2331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "4d41ff96-8dec-44fa-9d54-dace5663b90a", "comment": "Malware payload (MassLogger)", "value": "a056a26c3e28abc249956bf3113e3e453ee92029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "c287c4f2-4c23-4044-88b4-eb19288e4163", "comment": "Malware payload (MassLogger)", "value": "52f55d6cc8969e3c9501cbc834a651f7a2f278ac61875a54e4a64a48fb561ee6e42f9c7bca1ddb281c5dec52f5f50093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "6bcbb184-8df5-4fc9-a001-647016d0d394", "value": "T19E45CFAC3601B59FC853C9368A64ED74AA146CBA830BD20395D75DEFBA0D997CF041F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "da4b518e-d658-4426-a430-7b5d6b42629a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "f4cbfcee-fd76-4a9f-9a91-e46dc111968a", "value": "24576:Q3KOfkPHCGbtvEs55vtiM60+BaB9n9SDSSuds+eA9s:3OcPHLtvEsiM600UfSVud2Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374139, "uuid": "85eb774b-94d8-4ae9-8ac6-4d131912c9ab", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374139, "uuid": "4cf68c95-fd13-4372-9ebc-45870ea034b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "7d195e38-5813-460c-a2a3-7e43842a4810", "value": "0da4925cc323464f2f002ce18116856a24e065fd0bd32acf9eb5494876cf2331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804f7c06-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786339787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "c7293954-03cb-4e22-a93b-325042ab9839", "comment": "Malware payload", "value": "110f76d622ded8035b6c854065e916e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "17725613-2931-4a58-b3a6-ac77ba3b838c", "comment": "Malware payload", "value": "0dcf74772dd074dfe0debf03ece61b81e29d5a6e2778d6f9cd80a12e4d4f0a91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "b76a7971-e7fb-46f5-9908-c696d520ccaa", "comment": "Malware payload", "value": "56426222662077bb9353d87ac1e0553e8950a3f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "11d370f3-22ea-44a8-80eb-6073b2e57230", "comment": "Malware payload", "value": "ef81c1c42b3171a74fb371b8443613c94259cb99e1f388b85c2ac3d22e68480a0fc0d63e3f90a40de697175bdc400633", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339787, "uuid": "28cec288-bbe2-4ddb-a0cd-88670f06a03f", "value": "T129E061D3F860E621F5CDD03D5259659481C3086B2374BEF1F0435E704D1C1453C6E7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339787, "uuid": "d63f79b8-5ad8-4253-9ab9-fb7282d2a748", "value": "6:higjkTFfFFuJ6XVf6gdlCtuiMIlRr6+wFkREuNFPE0X9C2FZN9olBCqAVFgpQ:ASkBFFrd6gdlCIiFu+wFk+W8SlF/HjgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339787, "uuid": "1170c27f-7180-41ea-af3a-3be8f7611d61", "value": 395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339787, "uuid": "97daef5d-ae12-4101-b6fb-0bd2312999f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339787, "uuid": "8659e428-ced6-4241-89d2-2c340833c36f", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98017fca-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "721f5d65-201c-4f78-ad52-f7e5652ac1f7", "comment": "Malware payload", "value": "46feaf643bca0df35a8dbadedce14b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "f0e94d76-2d19-44f7-8a0a-0799e6577d9b", "comment": "Malware payload", "value": "0e7046b9d52206b0334e124ffc17d78c29cd4f6bfee460bfd218be3f3b7a0e53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "70fedaee-3dce-45d8-8444-ceb51fb242ad", "comment": "Malware payload", "value": "94565984622eead26cfe42917b626c503b26f386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "c496c023-71dd-4621-b100-341c4531768c", "comment": "Malware payload", "value": "9ba036885742603cd6a57911e3ebbc9e67bc1f849a5d052808445a424892bdb27084734b6a863f94b5f7dce2af06fe11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329948, "uuid": "f15016e8-04b6-418c-8943-87f676db0540", "value": "T19BC3B3576912587EF4B203B105DECAF83E23A1F792B70D16682B1EAD5F13E959F060C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329948, "uuid": "7143b489-9473-4d7a-a4e5-344f53ed0f54", "value": "1536:pvwk+YQMpzAxjG8hxW8XqnEYb0tUJclXiUn5p5M/LWt81kZxug+XskqQVn0Er:pvwk+nMyvWrn/bknlXihqtjZ2sFCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329948, "uuid": "62674cf0-1467-4240-a6eb-fcba8177d8bf", "value": 126952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329948, "uuid": "32fe582e-82d8-49a4-aa53-11d2a1078d0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329948, "uuid": "68b2f2a8-bff0-4162-b75a-bcead4637ba7", "value": "main.xtensa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8889f479-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786372013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "1846ca3e-ae30-4acf-93f8-c9e16cbb3385", "comment": "Malware payload (AsyncRAT)", "value": "f03ddef69caf6b0bdd009f2ec1f41c0b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "f49c5430-4124-4775-bdb6-2afb70e5f4c7", "comment": "Malware payload (AsyncRAT)", "value": "0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "cefb426b-80d0-4dde-aaa3-c6c5ea7033a6", "comment": "Malware payload (AsyncRAT)", "value": "9fde07b3c8e28944dacdb8bdfada5a3d8bdf5eac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "e2d26c5c-6611-4e2d-9d3b-71c0ee84aa2a", "comment": "Malware payload (AsyncRAT)", "value": "6f645938ce3d0d1e5fd360723ec5a5a7171d1ee1f12f6325e92fc14fc852cce76419aab966f743010c989d0eb3d2ea9a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "1f902a41-5832-4ba1-bfbf-9056d3545ebe", "value": "T129F4121C6A1BE917C54013360BA1F275127E5EDAA812D227BFDD2EDFBE32B168D401D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "0edd555a-bed6-4b60-86bf-4c182e948476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "d9ff293a-642d-4761-9180-a07cfcb20488", "value": "12288:yS1FlJdbPoA0/ncMpxV3AmQ4ZiCLQY8QUqf4NkAHAPO4xwoHZzAeETkmmOHBsNBV:VFd0/n3pxOmQ4Zi1nqf4SAHAPOYmTXHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372013, "uuid": "4966430b-2ff7-4b3f-b171-b56e394557d7", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372013, "uuid": "9ab40e9a-aeb2-4da3-a083-726ffa675aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "c3b5e8a3-c0c3-4e55-bcf4-617f0c476f4a", "value": "0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3411cd20-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786369294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "21de75e4-541b-4545-b88a-051668b17ab6", "comment": "Malware payload (a310Logger)", "value": "d1a24dff034ba1685c27df6301f07bda", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "e651e182-8b82-4704-b80e-69738e871cc4", "comment": "Malware payload (a310Logger)", "value": "0eb859ee673e74185809a19b7b43da124e500f128fd3cfb94272db5ffb88511a", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "b1b936b7-84e3-4b4e-85a6-3b2757c1232c", "comment": "Malware payload (a310Logger)", "value": "2f06ee1cf57c55d9d8e5ecd1f944c0170704e05f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "8551b452-072c-479a-a90a-33724fbe19e9", "comment": "Malware payload (a310Logger)", "value": "f4797347e871c030f6b37cd3591bd5b1c7880269e06ba6b09e36cb0e2eda330da5b9308571027d3e8d2f32161350bbb6", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "13af61c3-af11-4846-ac85-5ac43c68e8fa", "value": "T13C944A13EB60A11EF1A389B1B8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "2e443d29-f63c-4304-bb74-13a3c1eea8b6", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "a624214c-e2e5-4fe3-98aa-d33c7d5d300d", "value": "6144:L8d1/w5KA81IJ8GpF6nuTmOOUiBUrjndYleLoEXx+tYn1GnKEy4tMvbyy:QjYKkJj6GmZUiqr6KXFTEy4tup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369294, "uuid": "e2e6078d-d3e0-4e89-98c0-9817c9f67a37", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369294, "uuid": "5abc15b4-6d00-4836-8963-311b8bcbd6c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "afdd2e96-572b-4c79-8bf3-05fce4a55827", "value": "0eb859ee673e74185809a19b7b43da124e500f128fd3cfb94272db5ffb88511a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67bce2a-94ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1786388089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "deb7dd85-8c4c-4304-b298-5e9cff73506b", "comment": "Malware payload (ArkeiStealer)", "value": "e230b0053ada6cc7cd7f7ede601ed977", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "dcac2046-2e8f-4d89-8c2e-e91393857664", "comment": "Malware payload (ArkeiStealer)", "value": "0ed0b8553a53a330300c5dfba08f7e9e882da16b301b06d8cb227efbcdb9132f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "b9c296b2-7298-4521-b22c-9e5b520ea0b3", "comment": "Malware payload (ArkeiStealer)", "value": "14b01199609a14fe57553c762d35896407c80d0f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "a1f8e4cc-316b-4c62-9396-6f9e06f59c0c", "comment": "Malware payload (ArkeiStealer)", "value": "4621f7716bf73b7f54e739190f3ac5e472b96aceb1920daa0b7bbac7f2368b648796cdfece1e202d10b7e87ea96dfd6e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "f34956d2-af47-4070-8d0f-b044db42253e", "value": "T181368B03EA9658FAC09AAB3888774291B674BC4D4B3037D72E757A742F723D11E39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "9e406e07-6d6a-4ef0-8852-fbf5f5690f7c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "affcc5db-5ec6-4dae-b736-54900e035316", "value": "98304:cI1EbvpsjpQZnNjCmZkZknTP9ivYRrNn8yf9:cpW9QZnNjCKkZ6D9ivYRiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786388089, "uuid": "4ef42117-78b3-4f3c-93c4-627ac46eae84", "value": 5196656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786388089, "uuid": "0f0e71bb-799d-4a7a-80d6-efc78fdc54ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "5527c94b-fa2b-43f9-8ba2-e72c32c2c6ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8afe19b-94e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786385462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "609da5ab-f2c1-41e1-959a-59a85eb937f2", "comment": "Malware payload (ConnectWise)", "value": "83a84101ddf5da078a74ddb6df11e08d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "fdfbadeb-be13-4b6b-a9be-8a00b0294fd5", "comment": "Malware payload (ConnectWise)", "value": "0eebdbd4fb46d04352fa09ce96cb34991bd5950cf8a8be9e403ddb1d485a870a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "86cc525e-ffd8-47b2-a6c1-1a39b4b34373", "comment": "Malware payload (ConnectWise)", "value": "cfaacb94af3a48446a5543efd12f204362f63913", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "b957c560-d640-42b7-a8a1-9fc4c499c18d", "comment": "Malware payload (ConnectWise)", "value": "caf8843baf4fcb706a8c07d1370c45d42396b2d8f0c48ce5289f164ceb851de0b2c6e5dd06d4c13c2bcda7bf21ff1865", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "fc475d1d-6700-472b-9554-fe4bcae6f51a", "value": "T195646D11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "e48771bd-212f-42cb-bcfa-42ef2821dcee", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "e4a1fc87-70a4-4f75-a55e-08891f38fef8", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji97:h1iw7gryNkSV1hy1Z1u2JLu97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385462, "uuid": "7d4b78b7-28a5-49b8-9af5-4e64bf108e57", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385462, "uuid": "26072377-0e81-4151-a91c-b6333be58498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "df1990c6-219d-4ec2-b610-ccecf85b90f0", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aec11f7-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "74253304-57a1-452a-a2e1-0dcac15d4d92", "comment": "Malware payload (Formbook)", "value": "6f33923344b87bcf282f7f1839511431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "9a001e26-a348-4e9a-ac8d-5e0687f5b7f2", "comment": "Malware payload (Formbook)", "value": "0fe236a4aebe9d3753ec755a064ff42943528c99f7cb0561265dadd14ad425a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "ab92b55b-ecfb-4a27-be51-1c0a603c0f48", "comment": "Malware payload (Formbook)", "value": "2cb39ce61a166455a03ab23d84eefc3fd679e8e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "b2d68bdb-5576-43b7-9802-3064a15535cb", "comment": "Malware payload (Formbook)", "value": "f5192549c3f4ba0719e42dfe4cfa580d9f0684d18efb3b572b61fd4d68c3c4cc8e1b2840d1a46ca2f7a530f1cfbb1ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "8d7c5442-89d0-49b3-9467-8f043be10640", "value": "T12D3512546F1DCC11C4E217755AA4F27412B86E8EAD21C6179AFCADBF3DBBB022D00762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "2b320205-b604-46fa-ba41-ad447933625b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "aeecb3c9-6d09-4db1-b4e6-9133d59706f7", "value": "24576:5rj/ngNFb54OY9pXqgt9Bm7X1ruRiF1GOxbOHMC6Z6UFz2Wo1eUa3Lbv:5rj/ngNFb5479pagI7X5uRMLbkMBsAL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370514, "uuid": "98f78dc7-1811-47cb-bb4e-c9c302808cae", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370514, "uuid": "46961afd-8f4b-4574-99db-922eb9b20d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "f60c5097-55ab-4cd6-9578-3788cb07fa48", "value": "0fe236a4aebe9d3753ec755a064ff42943528c99f7cb0561265dadd14ad425a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd022b3-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "fe1844b2-d8d4-4b40-ad4c-fd65ceb99d38", "comment": "Malware payload", "value": "0db86c009fd1239c7c2edc9e711bbd41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "022e5a95-6941-409f-a73a-58ac365518f0", "comment": "Malware payload", "value": "10bb24172e32f87ac9ef1a7eee4a2f42a587315a72d5b25816cef834a89e8321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "4881b647-0246-4422-b337-407d3c8c9548", "comment": "Malware payload", "value": "d1dae19a17c86cb1f1113008bc8ec67f164740c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "4cfbef3f-3f9f-4e22-8fc9-634b7ed347c2", "comment": "Malware payload", "value": "8e4e9623e4072ddf48dda0a61444fd0a938bb4bac35805c1e6e1c74c15c8d3d9cd5e93c1b859a2e9e89ea4e02fc79184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "5728ca4f-ae51-4a07-b206-f97a37b28928", "value": "T1E1D4E041EFF6EDB4CE34857F86A572725E3E7EC804B5795E2208B5697DB8D00C824386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "6730eb78-e7ff-4a08-93b5-508b2c743eb7", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "3e466e3e-90fe-4f2d-a848-a409bae02916", "value": "12288:WBQGXvu2mtzC+k6/lC0Gdhg81zRk7aeCnRuAkfrA:WBtX9H5OfGde81zGCn0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369042, "uuid": "c89a030b-ab9b-4302-825f-f08ef5b65d52", "value": 637536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369042, "uuid": "64f13ea7-788e-4cf6-bab1-7e1b361746f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "d8c52058-6286-4241-bd5d-ac4336c0d477", "value": "10bb24172e32f87ac9ef1a7eee4a2f42a587315a72d5b25816cef834a89e8321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc0702d-945d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786326579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "18019bea-901e-443e-a7c9-bec55b7d96ed", "comment": "Malware payload", "value": "7619b80e26d31581355aefc1ff867bbf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "141dd93c-3d5e-4e62-b037-79dfb27c6719", "comment": "Malware payload", "value": "10fd2c56ff14202d44aeb6ecab9ff5cf36c148bba9abaaa641496de2319979dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "4aebc2b7-7332-4efe-9174-87ae42326aff", "comment": "Malware payload", "value": "6450a575c9c838659cd2af50aa928f7e5f1ba22d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "1491d695-3d25-4f8c-a86e-f257547c98e9", "comment": "Malware payload", "value": "ec2cc7ffa32685d13b7007024e631eb40a6ea6aba4db2a9be8f4093a6f6ae446c8bebf96bb595c688f4f83228e22c2c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326579, "uuid": "09ef0d44-0235-4e84-a159-2e1af617f081", "value": "T1C7316EDE06202A311512CE5EB3A3319CB6CDA1E72D9FD7D4ED481EA942897CCF261B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326579, "uuid": "0e26d691-87e2-4f5b-b59c-522477172074", "value": "24:zi0tWL9LHH7dDhGfRbbsi56ZJLac8c6uzXto3T9zXZ7Z8X/:zi0tWL9LnpE+ApduzXtq9zk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786326579, "uuid": "e777b7a2-c8c8-42dd-ae58-bc334acbbe20", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786326579, "uuid": "fcb1029c-14ee-4f52-b94e-62623fae7933", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326579, "uuid": "662cdbca-7ca1-4d39-864c-04a6e559c7d0", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d0d3b5-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "d18e562a-5f44-48f2-bbc0-bd532e29befc", "comment": "Malware payload (Formbook)", "value": "cedb2b4e75f49c633c07c13b81684412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "65db789a-7d32-4d21-9731-c3be3e86c6b2", "comment": "Malware payload (Formbook)", "value": "1161554301dad29fa9b3558bf006f3fa49fac76b8aedd65a5b9ba14a9fbeee33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "1698cf92-2956-495d-8a26-51c7fa37c65e", "comment": "Malware payload (Formbook)", "value": "3baa9a8897a42af43cfec75ed1c239dc8004dc0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "8deb3f1f-b4d0-424d-ba07-9e4447e53dd1", "comment": "Malware payload (Formbook)", "value": "751430b2e488a0b47fcc14678c4e4f2b624ae588d8a5dac2c519b63ae793cb010b0a920fdf8b245392e7de0a1c4c8999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "41c79fc9-f724-4b0d-bf24-3f99d582a5ce", "value": "T109351254276ECD01D1C60BB11EB0E3B416A98D98E531D303DFFAACEBB66F746A845390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "d10c2bcd-90e8-4a11-8595-dc30395143dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "127c4a21-7b3f-4770-824d-2663e6ca609b", "value": "24576:qZkYeJaftoxTYhhj3VQImGv60JnbU0JJbadxW1GtCbi8crYDD:qZgsZFQF0lFvBw08Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369170, "uuid": "c168e86a-b68e-4378-a8ff-63a0f71b4a01", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369170, "uuid": "f6a265eb-f595-4c98-9d59-c2de24cbe750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "3be5d502-e3f8-4832-9dba-97728f61b32a", "value": "1161554301dad29fa9b3558bf006f3fa49fac76b8aedd65a5b9ba14a9fbeee33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97b21a8-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786368659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "59135270-c983-4090-8313-efcaa24d6fa2", "comment": "Malware payload (AsyncRAT)", "value": "064906f3233742f88dd2f8a227361895", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "2adce66a-4cf0-498b-a2a5-5e21561710b4", "comment": "Malware payload (AsyncRAT)", "value": "1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "c7fd66ba-4f31-459d-ab74-6f2709a25894", "comment": "Malware payload (AsyncRAT)", "value": "a85c814c02125b7d7d045683b28a40b4c4f2b735", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "a41e0ddb-c4df-49cd-b982-e17f67ae5437", "comment": "Malware payload (AsyncRAT)", "value": "778766aef2c0d1d2069c36e8d9c137b8960d80537223027e7da6d02f33c6e46865d72a7165b6ae6298b770c7c3999825", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "2abf8392-77b8-4468-a04f-650b17ef50ef", "value": "T1B005E0C03B29B709DE786A309536ED7943A92D69B010F9E67ED93F8778A93015D0CF42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "ac91af52-c6f4-470e-9c3e-43d628c1d725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "73149123-b3ab-4e6e-b6da-b7d48c6c8de9", "value": "12288:6lOzqZ47iqRcMUnVQIWNqUhmjtwHK0a3zB2eLmKggyWf12JzEq3KJCvOlE:aqGnnUpmjpt2e/glWSzECy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368659, "uuid": "27ef2ce2-e965-42fc-aeac-248cc8f58bb6", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368659, "uuid": "24d743ff-1043-41fe-8265-d765b8bc8cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "f9675be4-40f9-4a89-aa9d-7ee20ff84a1e", "value": "1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b47d6e4-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "f823ad8e-a19c-47c0-8c1e-80df727fbb2d", "comment": "Malware payload (Formbook)", "value": "2661489de6e331cbd9875ffae43035e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "72ef2451-4a2d-40d4-8f54-54755055f2fb", "comment": "Malware payload (Formbook)", "value": "11f3ef4344774c9a0490b077ed446f7be49ade73a0072682c921e5166ee24c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "349ca0ff-a0b8-430a-83b7-7c4adab7e3a9", "comment": "Malware payload (Formbook)", "value": "829377dec7c1497225d72aeabd6294f5b70c8e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "8ef92691-2e71-4cdd-b5e7-77f99f653e6f", "comment": "Malware payload (Formbook)", "value": "98c8dbb541b26713dcd93c38814c5cf799c2d76401181f2350e30bd8082d34dc54cd0c62bf0bcdde00ea6fde97a45897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "a453976b-55d9-4edb-90e9-9935f5b7959f", "value": "T1C82522889351801BE6CB977C69DEE031A7F4ECCEE622D2874FEE0CB77D522642416346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "d3aad24b-dfad-4467-872e-f5c825c91bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "d751941d-18ef-44c4-9eb7-c91de8ba8e5c", "value": "12288:VqeDCJsPraBl27sEikec2OicHG9F79MuWCiBnh3yPsLzIyuLgUf13S78pykw7cLq:JeJyGC7m5OPHwMuYdyoBuLb87oytO+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373655, "uuid": "6bbfb18a-5be7-44f7-847e-ed2566d2be03", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373655, "uuid": "b1e73e53-f0f0-4a59-9ce7-35b409997955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "9ee5ef8a-9830-47bd-a076-bcdf1d6b8ffc", "value": "11f3ef4344774c9a0490b077ed446f7be49ade73a0072682c921e5166ee24c2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9481e0f6-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "fd184903-a2d0-4102-b0b9-ca7f90c4e3f8", "comment": "Malware payload (AgentTesla)", "value": "1e69c9a58d6be0b71a5e12425f79e66e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "89b0e343-a7c5-4f88-9958-ded8f1627cd5", "comment": "Malware payload (AgentTesla)", "value": "1203b91790fca9a278e54674db530c661f7f6a1e885e2844e9811e1b5c07d66d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "3448f12e-cb8f-45a6-9407-4caa804245a7", "comment": "Malware payload (AgentTesla)", "value": "bda73d3d6cd2b5c9386e8048a08d2ff3db865a02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "e735da0b-b98c-487d-8c85-cbbb13d04007", "comment": "Malware payload (AgentTesla)", "value": "54e427328bff932a5e2378563e407983f11533c6c68df4f1f30765065395806d41b98f678c4e4ed034184cb8326a8dda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "5331d8b0-2e6e-442b-ba19-91173515e58f", "value": "T17C152251FBCAEA22C3825BF40EB6D17A13348D9ED831E3578ED7DCE77089A112494762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "6d14e366-6eda-4720-bc84-f1f1546fe466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "7e1f166f-1dcc-4c7f-a53d-5cdf42f74db4", "value": "24576:hrj/Og3JCfQur+ThyrVyjQicLyhNKvydzVEgOHs9:h/PZCfaMTi+yDKKdzVEgMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372033, "uuid": "c97f8ff7-0568-4cff-983a-90ba085c7bb5", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372033, "uuid": "2c45378c-e9cb-4ca5-857c-f26a6b201c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "74f3221b-7a5a-4e83-affd-078c90fc768e", "value": "1203b91790fca9a278e54674db530c661f7f6a1e885e2844e9811e1b5c07d66d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389542ab-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "ac3d5720-d284-4ca6-a73f-b726ada30938", "comment": "Malware payload (Vidar)", "value": "342914d874f2d8e8e166ccaee47d35a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "fe36f660-1fe4-4711-8065-7fe6060481f4", "comment": "Malware payload (Vidar)", "value": "127370762760e8dfb8053fc21233a4d17c028db8424293746ed732496cbf067f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "5c5d2912-108a-4e5a-8ba8-225752ccc43c", "comment": "Malware payload (Vidar)", "value": "e97f3745de2419f3c78d9b32d0e78e50e3e0cc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "6a2b3b6a-2462-4b4f-bef7-7c514c7a0d20", "comment": "Malware payload (Vidar)", "value": "af4a3e37bba925bb17672b0d105fc5019d78b7796279ce551deb0f2a07d56d256ad6419c66bf49599eb843ed24f0bf7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "1866709a-58b5-43a4-9aee-5fe0888df5f2", "value": "T114422BC3B1D6E0ECC2AA837C9DAB21778A663045036289BF679995441EC3211E1FCBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "185be29a-f4e7-47ef-ad90-69c47ed2d995", "value": "6dc49e85762e4ee01dd5464c00241541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "d7cc6133-49ca-42b6-bbcb-6c9841cbb5d5", "value": "384:Ouxb1xOP3mTjEKxmK/hvA9AG2vvEAY8UyB+KoblO:jnxxEKxmMvA9DH8UQqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368443, "uuid": "d3a31bf3-10fe-42d0-8b7a-552f00123f54", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368443, "uuid": "c54204a1-f0ad-46d9-8c22-9c3c828cb6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "b9a92065-7b4d-4f30-bba2-05314bb67cd1", "value": "127370762760e8dfb8053fc21233a4d17c028db8424293746ed732496cbf067f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf54a81-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "ba3a5d58-819a-4757-8a0e-b467288610a4", "comment": "Malware payload", "value": "b7e1f36ad48405bf531fddda69d8679c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "51284ae0-f949-4fec-acbf-7514ad600f9f", "comment": "Malware payload", "value": "12d972eb994082b515f2befe1fdeb801e8182fa114f4930cec450d8f4633ebf6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "9f997983-fdd5-425f-9fe8-4d2e070870e1", "comment": "Malware payload", "value": "0999eeb1580bf13501efb43cd67d07ab0c87f6db", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "ca9ddf88-d942-4285-b16a-b369e9d189f7", "comment": "Malware payload", "value": "ce4f130175bdd36de9d1e3caca11c5e71587d1d9601954951ac92fe927de14f3bda41d78eb61d865a357f3c0f6460f95", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343029, "uuid": "b0d66991-6c12-45da-aa6e-4bac93ee232f", "value": "T12B236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343029, "uuid": "64b3e223-bfb5-46bb-b918-ec9b07805048", "value": "768:DXRWNGxVi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9lxJcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343029, "uuid": "c7ea56ea-9490-401a-bd46-604e90ae2972", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343029, "uuid": "7d93b48d-9915-4999-81e9-e58643648c96", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343029, "uuid": "aa09302c-5261-4b3b-82bd-cc03bd809e91", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d760a4-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "31d21fef-22a5-4c04-b4cd-992bc21c8cb1", "comment": "Malware payload (PhantomStealer)", "value": "d94ee22726c9d8d05a8f4c4ce68b1bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "776bbf2f-cc26-4990-97c4-bdaf23b8ca43", "comment": "Malware payload (PhantomStealer)", "value": "12fb6e25d898b7d478f488ee0cc01725dc62925069f8682dae89d21f90f78140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "d20005d5-275e-45c2-96b7-66129959460c", "comment": "Malware payload (PhantomStealer)", "value": "f85c7f2dd89bc4507bd418e44c0880734b0d7667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "67c31311-6b9c-43c5-988a-d06c3d4bc051", "comment": "Malware payload (PhantomStealer)", "value": "b41fb4507fc35c1a2087897afd709c2524d6357ea2e2dd2b09670e2bcaabe4b46a9c7c1fe1b3b88840c0a2005a612613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "8b902692-4742-4324-8085-f311f030de6e", "value": "T1FA4512586B69E413C85167340BB2F3B9622C1EDEE111E3135FECBEEBB96AE064D04147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "dcc43b9a-c9c6-4d46-96aa-edcc14c8807a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "89205e85-9711-4bd1-8a4f-94fbd7470e2f", "value": "24576:oeA9sVDViMB38AA7Jxj14iK3bxl3Iab14IGWQY0ihxGvrz:RUsVrk14i4XY0B0SxMrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373990, "uuid": "6f70384f-fbf8-42cd-b9a1-8d17f190d72f", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373990, "uuid": "45a5aed3-401a-434a-bc0b-f97299aef762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "787ead6f-bbac-4139-a30e-8139dbe97650", "value": "12fb6e25d898b7d478f488ee0cc01725dc62925069f8682dae89d21f90f78140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd53ad11-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "3d690dd8-3641-4db8-a110-4afcfa96e7c7", "comment": "Malware payload (Formbook)", "value": "89bc5aa21e11c7505154c937047e8e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "461126d5-3573-4019-aeec-a38e94e04076", "comment": "Malware payload (Formbook)", "value": "1312514b9c2d54ac17f34803f8400e0e604fe091d44f5eb9985354b099263ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "4acba271-7b01-4b22-b7d3-a1e2e83c53b9", "comment": "Malware payload (Formbook)", "value": "dfe2162451b218e3fab6549101a7cb22ea25cd42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "13a0c7d7-f163-4989-b769-b0c190ad3012", "comment": "Malware payload (Formbook)", "value": "8830024bc5ab241ddfd3958092b0ea1e9b82a66c6d7d757cd7cf15d0e8925ebec5ebd9e21612249a53f22b0655f54601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "a2ff2f7a-dfd3-4162-ac1b-bc2adf7f2fc2", "value": "T1334512606245F206C98567780AB1F3B212B89DDEB511F3465FEDEDEF7D3AB124808683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "981f2564-63ef-48a0-ac1c-19cf3764200f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "065d119e-97cb-4b23-8815-6aa81d3945ad", "value": "24576:5nV/edOnMGY/j/eC0ZF8WJekHTqfokYmAw2agrxwMkTGb:oOMB/gFL/BkYmlgrrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371350, "uuid": "8bfe278b-e532-4f47-9790-011d609f2d9d", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371350, "uuid": "54fdd55b-b9fe-4fe8-a63c-253d9f6b93a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "a9a94051-742d-48a9-8d9b-ce651f97f038", "value": "1312514b9c2d54ac17f34803f8400e0e604fe091d44f5eb9985354b099263ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762330c2-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "e5b32e34-71a1-4358-87ac-825aa09d817e", "comment": "Malware payload (RemcosRAT)", "value": "5aed4f994fde051a96d3b90b3732629b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "1f1492bd-18fe-435f-8885-06d69d93f001", "comment": "Malware payload (RemcosRAT)", "value": "132334806bc8620a8900f061ba535b049b2c756a3987c0a8a3bd58a82bf45579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "20544a8c-13cf-495a-a37a-3f1cb2fe039c", "comment": "Malware payload (RemcosRAT)", "value": "fd38cd057a0948ea51ed666fa669d66fa9e96192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "d30e0192-a078-44f9-9ffa-e2cf57d905a2", "comment": "Malware payload (RemcosRAT)", "value": "0852c4af3464229bf1a53c9f8dfbe01ba25ad217f8da272b298a841454fb98a4c678addbb4baa306574e39f75cdedb49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368546, "uuid": "b357a6c9-8238-4118-a7d4-1c58a40c79e1", "value": "T1B375F1D83721778ECD56C8318528EC74A6502D7A6307F293A4DB37ABB94D147DF08BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368546, "uuid": "5250e23c-2395-48e2-a585-3936bff9089d", "value": "24576:TBukqGQ0zp8q8tUntSjDpx6Xf8yWTwgKAhR1i8BqFizMnjsBx5IYc8VAQQqKCng:ckhL90OtSjtckyWxD8KqAzMn4xdVAjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368546, "uuid": "6757c91f-10a0-4826-bc29-9c74dd9b4baf", "value": 1585152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368546, "uuid": "988602ea-9ae2-4fdf-b0ad-b629707bf96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368546, "uuid": "8239448b-8ec1-4af1-a5a8-dd94e02eb96f", "value": "132334806bc8620a8900f061ba535b049b2c756a3987c0a8a3bd58a82bf45579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee8287b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "3e995b6c-748f-4226-9ef4-dd91904c03f8", "comment": "Malware payload (Formbook)", "value": "0defaf5b9f0ebc7f3d3ad60069d67b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "3a6bf325-b260-4125-b6ab-f2353d09c0cc", "comment": "Malware payload (Formbook)", "value": "13280c6a70c48732b500b35f52da26c74cfc1a6bedf64d03304a96663b5d7938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "7f0e28e4-db05-4db5-83f6-1fabff4b9a89", "comment": "Malware payload (Formbook)", "value": "e4bd8c3f809e76ca11fa17e13cb77f3131cc8305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "405c6351-de96-4c3f-bf03-2b26d21f2b6a", "comment": "Malware payload (Formbook)", "value": "0772efe40e278d0375ab7d5329b7f5e9e3728f5fe477de014145f6b0e8e81d7b938ad735f160d4dae372ed52752ab76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "dc3956b8-ef25-4dec-8f45-2bf78dec8522", "value": "T16D35E09C3640B59FC853C9328A64EC74A6656DAA970BC20395EB2DEFF90D957CF040F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "6455e059-5760-47f6-a939-15fe11a3a4b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "20bda028-efba-4268-8ba9-9e0a51413191", "value": "24576:5Q46p7JkxOfow8qCEjxD3cF1HbvhMTOqF5+ZE3h9TzyxiN:0XhMqhdLcF17pMTP7Tzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371728, "uuid": "a5cf22d8-d8d8-4008-948f-ef50c23f1517", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371728, "uuid": "b50b00fe-b865-47de-af31-c3a339919253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "d12db644-c78e-4853-9614-d7834d87ba42", "value": "13280c6a70c48732b500b35f52da26c74cfc1a6bedf64d03304a96663b5d7938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4a7ab3-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "8852d917-714f-4a7a-a106-59f807ce74e3", "comment": "Malware payload (Mirai)", "value": "92bd261aab30589e89ac0e77beeadddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "f26c4938-fb9e-41a1-bb73-a490b8965540", "comment": "Malware payload (Mirai)", "value": "13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "72fee9a6-d636-4238-8d96-ef70190aa110", "comment": "Malware payload (Mirai)", "value": "7105b13258702a2d55c8a7a0f100bbe25891e54f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "61efd4fe-b782-44b2-a831-f8c3db7ab6da", "comment": "Malware payload (Mirai)", "value": "fff0b4f9e036b1d718027db7e94b40326db43e6ba5ffc097b47c6f61fc108ea0cc810f9c572f700db103f7c017cfff6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339916, "uuid": "213e64bf-f750-4a22-8303-fd09f1d8e2bc", "value": "T1D7840B98B5E2E2CAD1D4E6B6B31D784D37530735B1DB3146A50EDA3323EF18909BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339916, "uuid": "a38021f3-88f6-4911-ae82-fc043728b793", "value": "6144:IhlBa9Ws5eoDzt3kKN49ROFchm3cSiGP9sbTO5EBmc2+Tcm:IhlBa9lvDztE9sFp3oG1svOLc2+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339916, "uuid": "f4c1aa1e-cb58-499c-9b31-c3caed28ef88", "value": 401320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339916, "uuid": "2d026870-a8e6-48eb-b969-483ad76b5fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339916, "uuid": "eb718b28-a677-409d-b390-048de8eb7548", "value": "vlxx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56baf32e-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "fbeb2e74-2395-41e5-8945-c528395f1869", "comment": "Malware payload (AsyncRAT)", "value": "d21b04c9be144635b1beec0360ab90fe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "9c5290ce-0966-4368-9e93-48a55ab73d9a", "comment": "Malware payload (AsyncRAT)", "value": "133b106fa34ec8d599211f4ceb049eceb4f750f504f8e8d09df546bb65e390d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "2884b4c2-0820-49b6-8710-043fe85e6d3c", "comment": "Malware payload (AsyncRAT)", "value": "a2e3092c906f1fe94ca4cb607adb43ae7a2fbeb3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "cfd05934-2433-4f5b-8952-0290e85e7590", "comment": "Malware payload (AsyncRAT)", "value": "f0dd86200944b53ac27b77644b2419356e6fc8cdab7564ec3294e4b6a92d4a20c5d34849caf1c089d58ceb76fb66d870", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "e8a24497-bd5f-4bbc-81f5-2878477427e0", "value": "T176F4125C7A46ED07CD1123B51EA2F375176D2DD9BC00D327AFE9ADFBB962A084C14282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "1f76c95f-67d3-4321-a6c9-c30b901a6418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "e4eaf0eb-f890-499e-94bb-09548d19325d", "value": "12288:WlJdbwKcct8dfXaCiCWUeoCWzahUk8Mb+bwS3v8JQm+BbRjPufmB:W5WfXaCiCTtuhUkxS3vaQmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371929, "uuid": "8ec36772-db14-4db9-9af7-664e83bb580b", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371929, "uuid": "a26aef76-53ad-4422-88ab-1a8c8fe7e320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "ef8ad8b0-27aa-42c1-9e18-07c615b3468d", "value": "133b106fa34ec8d599211f4ceb049eceb4f750f504f8e8d09df546bb65e390d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36792b89-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "212b81c4-6d96-4aec-a35d-1467575e5edc", "comment": "Malware payload (Mirai)", "value": "6f6d00735299d81a446aa4ae6defd489", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "4b290744-e985-4eae-97c5-91b19dc05bb8", "comment": "Malware payload (Mirai)", "value": "137bf467e6e97d3780f3f75b3c44c89c222c738cce38f4a0e69f42a440ba6fd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "ae6cc1a5-e2f1-41fb-9ed8-0a71b5638671", "comment": "Malware payload (Mirai)", "value": "76787be67d3f4e784e0e2b5a2a394666816c60cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "19e3fe1c-13e2-4779-ae19-48552f0d9ac3", "comment": "Malware payload (Mirai)", "value": "faba801e3407760b1b6ceaadd2a09e6da7be0386d9bf68d56f05dd9cb7fc7e8553a9a860b4858e2355a47d802b964ef7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "e56bf485-4ea1-4427-9b3d-26679cb9d873", "value": "T188F37D80F353E2F6E84705B0617BEB339A359556111BEDC2D374DF35EC62902CA1AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "c202ee86-e732-49a6-960a-011c32c6e764", "value": "3072:JLIxaXdi+w3TIeF4hXxBaX593ReY2aSrIvwPzQ+P+:JLIxaXM+2RF4dkRB2+wPz5P+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356843, "uuid": "54bdb9c3-068b-49f8-b5b6-66966f54864e", "value": 159360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356843, "uuid": "09fc87e2-ab2b-479c-99e4-e371a8ab89d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "4290d5dc-1fc7-4573-bba8-3655ce49f492", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b52f8a5-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786345792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "51aa963a-69b9-469c-aa2d-9742ae1a696d", "comment": "Malware payload (Formbook)", "value": "a782a37bf4ce6685fc48053d0f211de2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "81fe9dbf-6a8d-4bf5-b4fc-91cd2e0829a8", "comment": "Malware payload (Formbook)", "value": "13b23ea947c504ef332e0e02c9821f02c21a145ad68e238e4cfc57f4207a3d59", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "ded38ced-6731-4930-8024-f47c191a8fed", "comment": "Malware payload (Formbook)", "value": "5dd0d62d6979442093e2c50c814c492bf4d5dae0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "9bbb8af6-8c38-4180-aacc-feddc400a830", "comment": "Malware payload (Formbook)", "value": "ec1bbf4511ba3a4b9557e830d7db64cfcef6df826febb04e447974b28ced022aec866b0a74e7a748487f323600e14982", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345792, "uuid": "41c3cd93-77af-4d82-a5c6-f40c838b76f2", "value": "T138E508401318EC70B63D672CD136AAE09A69211311C5EF2F34BC7644B7AEE17A79D9F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345792, "uuid": "1ae3a16e-7d23-4511-8583-33209e671e35", "value": "98304:Uyrp9P3/gkZWFVd8A61zSAbl8I0Ruw7Rp4LShiTKMlTqBInUDmg/dFqMgwc5F:RHv8d8VBoRp4LShiTLTqBInUDhtTc5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345792, "uuid": "05893c09-07bf-41e9-9450-6e1d94a9651c", "value": 3154342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345792, "uuid": "79e57e42-fc13-4f5b-a738-53b3eb0d8320", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345792, "uuid": "c1515121-adf6-4785-885b-4a1fd6bf4f22", "value": "RFQ#N05-337 FASTpdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5e3819-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "33ace76d-70a4-447d-a634-9f860512e57b", "comment": "Malware payload", "value": "2aaef534298e6972af1bf1e4e4d81517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "84b02700-6e87-4ec9-941e-8aef3be6e081", "comment": "Malware payload", "value": "13de9654042f1e01afde8ec6f3d48596cd75f55cd54b2387c65ad91ee1a48550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "fcf8aa1b-884f-494d-bdbf-39fdd86d38ed", "comment": "Malware payload", "value": "dfa3c2c32f6b3b2fe8e2e512ca135fa3f8610905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "a262d9cb-7494-4c56-89c2-8d75bb97031d", "comment": "Malware payload", "value": "d1fccce41f139c1b4ae8293c6b606de63b197c2246021f5a1a98b72873c0e1bd2812b57917a5101554df6eb1dc198934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "c16f1052-3aa1-43e4-a24d-03fde70f6baa", "value": "T185F30154E1EBC05BE127C1F068EDC731A670BE2607786E7F8461CAF449A5FC51A2C762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "fdf21113-4237-4151-92ee-6c76c6068509", "value": "c89b9a3cded6391777b60d810a4b36f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "68a025cd-a765-4fc0-b857-4e78f18b0d6f", "value": "3072:llbBMZPUp3tOY8WOvVtuvmMz9o168vqipdY8x2svgBYmXmiVZIAxGPVHd5wmYt/F:nbBMlLvVtkmMqBvpdYsnmWMYVHdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373630, "uuid": "a46d58f8-1b86-431e-aca5-cbae6f181655", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373630, "uuid": "5d619cf5-534d-4bb1-87ee-fccd991a868a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "16882cc4-b402-4817-9d23-97e1adcceadd", "value": "13de9654042f1e01afde8ec6f3d48596cd75f55cd54b2387c65ad91ee1a48550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506512de-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786373637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "93279e3b-2289-4c46-bd61-06b54ddeeae6", "comment": "Malware payload (DarkTortilla)", "value": "c5395576ae5a88f33ec5d5b8cf2475d3", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "42a1c4e2-0fce-425e-ba65-896c1d0faad0", "comment": "Malware payload (DarkTortilla)", "value": "13f47df57f1faad58a1c4bcc768360a572b9be93412691f55c49bdcaa2d3c1e0", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "9e3d7993-60e8-420a-a7c7-051407c2681f", "comment": "Malware payload (DarkTortilla)", "value": "c3b863ce95d8ee5acef3fcd24f96c6008bbfe3c1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "34dd5080-e948-4f95-bec3-4b0f158d149b", "comment": "Malware payload (DarkTortilla)", "value": "7add8f1e7ebbf770a697f74dfc7ebd7ea7153e960992cca69e6ecc351d77b5003daf4db7f7f771b6a195119ab9fdd70c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "fdce159f-6d10-4877-b7ec-768f1c307ca3", "value": "T11F85012B1CC756A5C4A84F78A3E804EC23F1532F5257E7B71AE512E9CE4238E69171E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "c59b2f0a-2c1e-4e82-8232-653cbb3c7f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "49591c26-b62e-4794-99d6-c7e62b27031f", "value": "24576:z6wxfcyjsvz6Thr2hGUNlerBlRqHN9tayLVXfYbV:WwZcEsvG0hGml4qEwXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373637, "uuid": "fa384d60-70a6-4a83-852b-9e4f1ad565cf", "value": 1796096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373637, "uuid": "3cf38754-69d3-4437-9397-2bae94232747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "252fbe99-afb3-4016-a14d-708092730ee1", "value": "13f47df57f1faad58a1c4bcc768360a572b9be93412691f55c49bdcaa2d3c1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba43d9ca-948c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "046ab46e-806e-43ab-a757-76dda3b4df6b", "comment": "Malware payload", "value": "7549019b787aca9f5a2c5dd1ad0203eb", "object_relation": "md5", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "6f2f801f-4cbb-40bf-9931-83d16487125f", "comment": "Malware payload", "value": "141079d8a6328c9764c1c74934fb6c9d5c9db12cb558e2da827dc45da7dd45f5", "object_relation": "sha256", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "f13a9f59-59bc-41c4-b6fa-c2b55d4dbd46", "comment": "Malware payload", "value": "96bfc913dc795114f14cf8a9f1fa26821da80364", "object_relation": "sha1", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "1bddd52a-f944-4de4-955b-255ff7346498", "comment": "Malware payload", "value": "4c5afe201534f2f222c3d48d7cf3d6d9dd2a7f03c9f950b45986e94fbf8a573073aec7a634f2046c893890bc1a83e098", "object_relation": "sha3-384", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346756, "uuid": "d0298da5-73d9-46f1-9355-d58056ad0769", "value": "T1C4627D206CEB10CDF2379B751BDCF9FB09A6E4A5292E72F421419A844B71AC4C863E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346756, "uuid": "f379a573-69fa-4044-ba63-09aa954aa050", "value": "384:YcpcEJ0cgPC56cSzoKMAkkTinWpotxN2kcuyfWCAVPkcqbckDHcLHiSywBY0RkE9:YcpcEJ0cgPC56cSMKMzkTyWpox2kcuiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346756, "uuid": "f365eb48-1f72-4439-bf04-8d82b619a3d3", "value": 14692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346756, "uuid": "98da5772-7fae-4ebf-a96d-80e377920172", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346756, "uuid": "5bfb48e7-8144-4448-af9e-0e49cc3127ea", "value": "AFC_Security_Report_2026.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bbc823-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "171560d3-30e5-4598-ab09-344eef04d820", "comment": "Malware payload (Vidar)", "value": "53d8e052dca206680a5e3a4dd65a30ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "3d24f88a-ee44-4eeb-b1ab-230aab9045bc", "comment": "Malware payload (Vidar)", "value": "14116dc0a5060f283a3360e3346f23c54cacf583447b44e5c68e518a801c4c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "67736770-2a91-4026-a692-57b695d72cbb", "comment": "Malware payload (Vidar)", "value": "a1123f63357864ae321fb61b4b52e0d3b7cae91a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "f24ade39-ba2c-4dcf-8468-de724412b482", "comment": "Malware payload (Vidar)", "value": "6114c4dff348eaa7e14a7d5336dba9d0a4a22196a9097641ccaeeaf4993c1c257e73d343e0d978c6c9130aafd8acb616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "7fc00eb6-624c-4b3e-a1ee-3e78b0a748d0", "value": "T19B52F88A71D7E0BEC2D84338D75A616AEB763089131E56FF97FC859037C2500A679225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "2de657ca-007e-4a3c-afac-968adc7d5070", "value": "de26b7edf94e4a571958e2e797393a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "16533f02-4cca-4e8a-a287-057c0ab0ae68", "value": "192:OmbrJ7+ufOFZoxVviQg457BQKQHXdRVeHQjvBHC/UgIzU3VgxV3Z:OmRKOOFmxVvii5SKQHXNjvBOUvUlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369462, "uuid": "9f1a5e79-cc04-437c-af7b-e17833046d4c", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369462, "uuid": "fd816563-8a14-4afb-ba90-354e01738ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "284cce77-eeef-450f-a01b-a3e88bfb8ced", "value": "14116dc0a5060f283a3360e3346f23c54cacf583447b44e5c68e518a801c4c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae640359-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786383673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "df5c44d9-bfca-48ff-9ac0-02aefa4e4d5f", "comment": "Malware payload", "value": "e9638bb06b2cad78c026a62af8c7ed4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "9f5b6905-a539-415d-8453-042e260fe3d2", "comment": "Malware payload", "value": "1429c59a338928e0934c019be499ca5325399b640faa5c4bd9fbb87efc4c970f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "0f57d7f9-6f8e-4990-a418-d73095d6559b", "comment": "Malware payload", "value": "8fce3399d027a683b1f3ebed018540ff8e5ca4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "8ae059db-55ad-450a-bc24-5db37552989a", "comment": "Malware payload", "value": "fdbdbcce0607877a39898325853c62d77f4948cea266c6f65c5c8356c570f797de9d37332da2d7ca8ecd22dcdd20a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383673, "uuid": "7ca03bec-22d5-4b81-9790-f5c036e5fc38", "value": "T17633195ECDA369706EFE5DC587893521E132FDBFE64B1F75288CDEA104AEA318831910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383673, "uuid": "c4e913a2-e2d8-4f70-8c70-15c82053ad3a", "value": "192:c7FqhnIhELBoxCjMSUwaglu5RF9QMW5w5MpiLp6P0TsVfcXsDwwK/oPPMctKd+Aq:wycIK/o/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383673, "uuid": "d5c5124d-11a8-4f9f-ae2f-937e8899ba69", "value": 53921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383673, "uuid": "1c30b679-feef-4140-b454-c9f36a6faef7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383673, "uuid": "1b0f8552-39d3-465d-8067-9ba0a523a508", "value": "Comprobante de Pago.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd32b2c0-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "9557ad10-9e1a-45e3-8bc8-59d48c15feac", "comment": "Malware payload (Mirai)", "value": "657b1872dec2d03b374de735f82fac6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "bf0c1b04-b05b-4bb9-880c-53ae3f95b7f0", "comment": "Malware payload (Mirai)", "value": "143b6ba7ad30818ec9fb2a55b8d49afdc3e8ae58b09fe68cbaa20c1e82a2b3c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "c172febb-bac3-4a52-912c-f6d154300f28", "comment": "Malware payload (Mirai)", "value": "9086699672da5fc475468db4e0193e9a7dc88e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "e493ca95-5f3b-4364-b3a4-d32004a9855c", "comment": "Malware payload (Mirai)", "value": "56f8604e0c0da5df82e973990fb803b1f3d87a484a52ddb8cae002131cd18b8f2753367c59f00548760b64bcb871fdd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340345, "uuid": "c6530024-a2b8-469d-bb69-9c47d99870c8", "value": "T13A746D8851F5F3DEE2C8F97953053C165872293630A3B296311FA6B753A62940AFEF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340345, "uuid": "aa2660ce-62c3-4452-9e53-133bccd70f98", "value": "6144:Pa9va9CHJ/ckT3tOcU1AfEkvB6mOvczgt8I7IuZg0:Pa9va9CH1ttHbfEk0RvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340345, "uuid": "df1d3a08-e7c6-4144-93ef-9e2a7b61f6cf", "value": 362424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340345, "uuid": "32970409-5ec3-4ecc-a470-d3227f7edcdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340345, "uuid": "d6e694c8-fea3-46b4-bc15-0e8a1755141d", "value": "pid.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340730ed-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786348249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "80aee2cc-3a9f-4df6-a80d-0f1dd135e3d8", "comment": "Malware payload (Mirai)", "value": "71714b188b4d09959396ee51cbc2e1b1", "object_relation": "md5", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "5ef6ca20-7859-434a-9fd0-6291b33ebc4e", "comment": "Malware payload (Mirai)", "value": "1477f5b9462dc62305abc37ddb0da17327145edf2f7c691927c101e455435ffc", "object_relation": "sha256", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "bcaf1b17-a26c-4104-9256-60cc99192e5d", "comment": "Malware payload (Mirai)", "value": "3f98e253410af6e5b353598d0381cb90b065508e", "object_relation": "sha1", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "04faeaed-3b40-43fc-ae59-bab14bc8d04b", "comment": "Malware payload (Mirai)", "value": "7f971d795d5130263105d1795c01aa6788b7f09eb9a6f4a2e51269a4191f75d11f5eba0d14967502e62b0f9c7507c970", "object_relation": "sha3-384", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348249, "uuid": "d3c71b28-3a47-4719-9c1e-17e9e5869157", "value": "T198566C13FCA555E9C0E9E2318A629253BA717C596B3123D32F50F7782F72BD0AA79340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348249, "uuid": "b427a55a-3cf0-4adb-9ec7-7f904633969f", "value": "49152:TCkr1Yzd6tEGPCFc4bFjEwlARYMB+iIw4V4bdTMG/nkXtgMBcoCDYM0JGwe3joF2:ekrWAu1914b4V4B4bWYfmd58vY5E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348249, "uuid": "acb38f09-247b-496d-bb00-9c5a403f87ec", "value": 6201636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348249, "uuid": "163af5b1-db58-477b-a38e-aab2dffe93af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348249, "uuid": "be514676-a15d-4b14-96d9-e1b70875d4b9", "value": "massloader_dvr.new", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ebad30-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "7ebc1608-6925-4730-b043-d4d1627da8a1", "comment": "Malware payload (Formbook)", "value": "a40da71cf54e39119c521137355e69f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "c6021990-5d76-4506-ba7e-e9e25dd50754", "comment": "Malware payload (Formbook)", "value": "150362f0b726124b5bc18e892421582c841329fc555c298dbd4b61622b8b1373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "f6bdb90f-dccb-468e-bd7a-7eb991ef53c7", "comment": "Malware payload (Formbook)", "value": "b70f69c14f252e83ceaecf3c5304918d8b35b135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "415353a0-3ee0-48c4-87a3-28fd9c5fe1f4", "comment": "Malware payload (Formbook)", "value": "39276261273b3741ec3deaf94476a7e124e25bdcd5d1cf716b35a6dfd0aef3a57c07e84164a5ca595e555c2955312671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "d9710c6c-3f61-498b-bfed-439be146b53f", "value": "T1FF35229087D9C121DD9917BB19E2E3B00379ADC8BA26CB6E8BDD7DDBB5233400D25742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "81ab0364-63c0-42c4-8455-2d7517e902a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "29101279-a38e-4308-93d7-b110ab104a49", "value": "24576:DW+bNa0n1CWi3bxFXrjvia5+mBAvGXXTH:iejn1CWiPnmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372245, "uuid": "b03e8314-0121-4545-8ada-f3c8a47739e9", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372245, "uuid": "e1db83ed-5739-47d0-98b4-4a5135071870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "14119c1d-daeb-4104-9c3e-dc8347fe8b49", "value": "150362f0b726124b5bc18e892421582c841329fc555c298dbd4b61622b8b1373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb153b3c-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "92f5a0d2-865e-49d7-808b-831e2d6af321", "comment": "Malware payload (AgentTesla)", "value": "395a2b5ed3e2f1b84ffff5c5e78e9e24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "9118e054-53b1-43ac-bf9a-4343136dc55d", "comment": "Malware payload (AgentTesla)", "value": "155dcdaee0c38c0db66be4daf5f80a6428fd13e05d701b37697b596c8141c956", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "aaf588dc-dae6-492e-ac7d-fb1341050f10", "comment": "Malware payload (AgentTesla)", "value": "f7da5b9814adbee6ea39d82b036bbe9b7574536d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "3c95bfd1-b4c8-4e99-b2d6-a0390b8d2ba3", "comment": "Malware payload (AgentTesla)", "value": "5bb43990fe924bbeff5eac9f5271fd813abb949e63fea6c41da468ab3c2c049b3a2e6914b2c982de8c8677fde3cf01ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "685c33e3-b666-41f3-8ff9-4a73d12b8feb", "value": "T19F3512502348F613CAA567381AB0F2B913F95DDDA411D2068FEDACEF7D36B020A646D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "bf35affa-122b-487e-b6a4-5434d532243c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "6ab87889-e012-497d-8b8d-d4d7e7af4705", "value": "24576:PV/6uBVcrTIo2L2MtvrVzZQ0QqlfWOsuO79Oc:vB2EvL2MtvZzi0rfbbo9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371239, "uuid": "e9d4d79b-2639-4740-b675-f13964144bac", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371239, "uuid": "d291a00d-97e9-4fa0-bb1e-94b7606a817d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "70d33472-c5d1-4bee-a7f8-001891b7a605", "value": "155dcdaee0c38c0db66be4daf5f80a6428fd13e05d701b37697b596c8141c956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f87633-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "7965db26-5bf5-426c-9115-ca1b3a21e0f6", "comment": "Malware payload (Formbook)", "value": "f980940a63d56553073283f42a3362dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "e63a8d76-f494-4ec6-9d43-efc6b24cb676", "comment": "Malware payload (Formbook)", "value": "1648a7d78c1db3487849d3c7142d934031a85eb99a8f7b79517ffc296b0974fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "b8e1b7a6-05e0-4243-8fa6-10774662c4cd", "comment": "Malware payload (Formbook)", "value": "2a6d137eff8fdef6e096786aa0088d7319bcc265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "9f2d739f-c1d9-4b62-9c3d-b6f3cfffd27c", "comment": "Malware payload (Formbook)", "value": "3ca959178f23e6e9376c1e24990b469b9f2adc7fa6c801ae7a029d389e808abd97162c3b0c71dd0d326511227c3010ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "d2be6e58-5c84-4b79-be74-21ec8a68e530", "value": "T180350254321ACC06C6935FB0DD70E3F415B91D98E421E373CEEA7DABB87A2867C16291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "dfc21bbd-1236-4aaa-a7b6-f61a65530442", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "722f2a50-eef5-466d-92f5-ac8f45493712", "value": "24576:A/jR6pFsRFxhwCu5aoawO/7wKMeiwF2lB0rkRTg7oNhK:wtimRnQyVF6BPhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370906, "uuid": "a21c6b27-867b-460c-833c-cc7428588d9a", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370906, "uuid": "3b7a4278-76e7-4004-b5bd-c2afd47163b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "073a7f0b-17fe-42d5-bd23-a68a7ab8ce65", "value": "1648a7d78c1db3487849d3c7142d934031a85eb99a8f7b79517ffc296b0974fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23a79dd-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "3af927df-b50c-43cb-b0e7-d46d5593931e", "comment": "Malware payload (Formbook)", "value": "4878bab2368e5d0097b2a9ead24d349d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "00a79d5d-533d-4ed2-8e5c-6c9ba65c4802", "comment": "Malware payload (Formbook)", "value": "16751184487fa5b1cfcc7943ac6219834c895568992a879498124b9a5cea11b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "55afd01d-2d35-4440-bb64-e3b0ec4ae14b", "comment": "Malware payload (Formbook)", "value": "c683c9428a80ed2a438b68d573d41b8ebe4fd703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "d1af1f81-afd0-40de-95be-39c6c3b21615", "comment": "Malware payload (Formbook)", "value": "9dea6ab771f9da1e6f6e9cd551fd8601e85631155678580cb6fd51a1520f4846c3351e9e9616320429d12f3c232f8e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "22f0bdde-0960-4e58-ba85-d5562dcf6239", "value": "T15C350254231BCC03C6D31FB11D70E3B815A95D98A915E373CEFAFDABB83A6852D21291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "c4d126bd-7ac0-4c90-8f6e-1fa20f5e1af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "3a54c1a7-e2d9-4400-8352-97fadd7092c8", "value": "24576:GhjR6pFsR605ieMfR6C6TDF0+211othuwwrECb1f/tIg9vz:UtimR60Mft2hyOh6AU1f199vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370848, "uuid": "9ea3a88d-c053-4324-91b3-b7b03c6fb694", "value": 1143296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370848, "uuid": "b6340c37-efcb-4ed1-96d6-fed8c2e96c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "d45f0509-8641-412a-b992-6278fd2f91b9", "value": "16751184487fa5b1cfcc7943ac6219834c895568992a879498124b9a5cea11b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce77b97-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "e57d21b6-003e-4ec3-8829-cc50ad3e3658", "comment": "Malware payload (Vidar)", "value": "82e99d6cb1bd620f118f5f3b074e92fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "0b054d3c-4ba8-4815-b1e5-1467dca384d6", "comment": "Malware payload (Vidar)", "value": "168e816b20a334ee0068b336d7f656ed0d50f6b9d1853c7ed69ce7be8be1a211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "81ec0a1d-07d9-475c-a054-f0686403557a", "comment": "Malware payload (Vidar)", "value": "1eb9223aa4bab7414c0c52aafdbbe4db0f665a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "3734043c-e520-4a4a-99b2-70f7e71d9018", "comment": "Malware payload (Vidar)", "value": "e8ee97cfa8b6f03df128a95114d48288aceea8bcc26694df215ca67ee7903d6fc48a0e84ee9e33098f77d70cf94d736e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "dc2eeeb4-8f76-49a2-baac-6a88ef08c184", "value": "T187420BC9B193E1ECC52AC2BDDBAF07719F363080530E6FFF06D8D5546792211A964268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "70afd948-06a0-4814-8777-02f3de5092d3", "value": "850ee0121fda1022e1c1de250e3e1e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "2dbcfafe-5eda-415a-ac19-349a360397d5", "value": "384:ODeQcQTeaUHBzdm5QXQhkXsiDhVhO2IFlO:0eQcQTeFm5LOXsR24O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368907, "uuid": "12389e55-7024-4a39-b893-5c0bda98894b", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368907, "uuid": "8c0a2346-e5b4-4420-8179-633d6d5c380f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "6d277d7a-64c1-4e68-aed5-a62ff232de38", "value": "168e816b20a334ee0068b336d7f656ed0d50f6b9d1853c7ed69ce7be8be1a211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fad92ea-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "075dd310-ff2b-4aea-ac3a-8deeed1166a0", "comment": "Malware payload (Formbook)", "value": "ce011ac41a36d28795ef81afb2b15f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "f5eae0f2-ceab-412c-a01e-317f8387139d", "comment": "Malware payload (Formbook)", "value": "169613669b6c92b3e6a94e724ee919f15b1e29168dae09dd6123d0f09654a2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "5e4ca317-d259-48ef-9887-1e04687997b1", "comment": "Malware payload (Formbook)", "value": "757172bd22dc22efbca7edc7db04fa9c3bde92cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "9f4fa284-c1c9-4632-b16a-2f315f94f1fe", "comment": "Malware payload (Formbook)", "value": "4faca8e2ab89711f0a5182f288cacddab9eabe8559ef5d5a1c564775e18e460ab3564b34ef7198712611acdf3ff23a4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "a43a6d7d-e343-4311-b859-d0d8b191f8f5", "value": "T15235124CA70DD90AC4A157708D70E2FC066A6E5CFA21D3139FECBEAF79727560885392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "a83092a4-672c-47f7-8dac-ebf2047f7dd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "8cbe5d3b-06a5-463f-8f13-e8f39f2859fb", "value": "24576:kXjvV0LcDHTxrWvJ013WBRysPPCSiDgsTx44J92:kXjN0LcrFr+K13WBdPMva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369448, "uuid": "c8bbeb2c-21a6-41d9-935e-ab5c786e52ce", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369448, "uuid": "5328da87-4c58-490f-90bc-23b603d3d0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "c37ef103-c53a-49bb-87c0-c7a5d3f1e862", "value": "169613669b6c92b3e6a94e724ee919f15b1e29168dae09dd6123d0f09654a2b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71805abc-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "aa269970-4041-4c08-b652-d9a84225d3db", "comment": "Malware payload (Vidar)", "value": "c39452e4c2422eaed9347dc01927d750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "6ad2d40e-6f97-49a8-a38d-f7ad0fc8c7e4", "comment": "Malware payload (Vidar)", "value": "16a0463ca3974678c43689903df41dff75795ffb8268af7fab97c143d3d1752e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "d2a32cfa-79e9-4ad9-81fd-d4ab2d48bac8", "comment": "Malware payload (Vidar)", "value": "c9bb3c156722a781a0bc718894e7fd5436bcfad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "bd9151e7-9fc5-4fa7-be1d-9fa7d854750d", "comment": "Malware payload (Vidar)", "value": "a120e5db7b456a3cf39abef6ce5927f188ced2c59ab8a0b5ca81397cb17e433c76e224264805fe4d043c92615b0c8cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "21876805-0592-4aae-9a5d-80f33c48f131", "value": "T130521AC770D330BDD2A9C3BCCA9F2676D662348013264AFF15EC869416C39117978B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "08168301-cc19-4bfa-917b-672539ca55af", "value": "e23bb1c08602479266491150dc857434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "5def5f2c-011d-46ec-8e6e-8457b8349678", "value": "192:O9vU1VDGvFPHBshmTv5ea4xtLJCyQkxluldsgVbj03V:O9vUfD+P2hK0a4xtdLQddsgVbj0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369397, "uuid": "10d99348-727f-419e-a640-ac06825bc6bd", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369397, "uuid": "972b67d5-f1d1-43dc-bdd8-d10a363d60bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "2685e339-6652-4a38-8a23-93f10ac434ee", "value": "16a0463ca3974678c43689903df41dff75795ffb8268af7fab97c143d3d1752e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47baf986-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "275b942d-f9a8-4aa6-b5ef-f530774edf87", "comment": "Malware payload (RemcosRAT)", "value": "d337760cf94c2c593794a35b9c825a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "0f871b56-fe14-4b30-a6b5-5e722baa15f0", "comment": "Malware payload (RemcosRAT)", "value": "16a5e7478afc842e882cb5115853e6c2bbbd112d985e679752dc51c3a4720bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "b667fa82-c338-42eb-8a42-e6807b87617a", "comment": "Malware payload (RemcosRAT)", "value": "480531c4cf3384b1fd0907449dd57ace63c4b314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "e80dfa8b-a1a0-44be-992f-a7166172c558", "comment": "Malware payload (RemcosRAT)", "value": "e97a1cc898abd133a6062d968a7921c4daeee8203c4926f838425be5fd55ad5d4bf9a356517b858ec751a1b428812566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "fdf9fe9b-34a6-4062-8491-d8d82b431177", "value": "T13A552359D1818123DA591ABA2722F33537B8DCED3830E205C7DC6DEB7E83FA28955163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "ac585992-7918-418a-84dd-e85538c2d682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "13b958e7-6dab-4b8c-b20f-7b1a95f6aee1", "value": "24576:QHBYg+g6KSa7dYIiik78MWH8hYBXUQhwHsAgkat6+04HZV2YoIHBYxHBY:UaLMSa7dYIPvMWvxx+MFR3/V2aata", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373193, "uuid": "b96d09c5-0158-4cb6-ad92-009d67cb3fff", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373193, "uuid": "5357b768-3bfe-4379-84e9-aba9d60cc16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "f41fe6b8-bce8-452b-b1f2-ac6f981011fa", "value": "16a5e7478afc842e882cb5115853e6c2bbbd112d985e679752dc51c3a4720bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a446b7dc-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "cee979c3-8a2b-4838-85c0-5a4b7a126318", "comment": "Malware payload (Formbook)", "value": "cc96c83e52e24db1eca09d1eae3ee89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "7fd73a13-791f-41c1-abb3-738d9ea1333e", "comment": "Malware payload (Formbook)", "value": "16b77ec1264f00283bd08b00a72d652f4c47835c35bc906d8ba0906cbd371eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "1e34ca52-b2e5-440f-8c52-2419040b4349", "comment": "Malware payload (Formbook)", "value": "47faa2416c811e991c736c9919a6774e75aa10b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "b17bca8c-d23f-4576-86e4-df5dbb00b4b2", "comment": "Malware payload (Formbook)", "value": "4a8d856f092e9500220b71eb74e9a4289e4c83f9607ff509b202ee402fda966bd2117b2d904aeb526ce7aea66be0ab0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "5c3c9b19-22f0-44dc-991a-2bb9e83229dd", "value": "T1DA2512986C02CE16D0870BB18CB1F3FE56741DDCE911DA57C9FDBEA7B8356463908A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "78859ea5-1716-49b6-aad7-50bf7e5a02fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "f4020e66-e806-4390-8ecc-7e6a6df5ff66", "value": "24576:4a/cWX+LfHUBJ2i52xH5it8Ih77DqVS1jt4ACWq5p:4a/czU+ikit8IFDqgFt4ACjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370771, "uuid": "acc09ee3-2b25-43b5-9e3f-e2f023406b22", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370771, "uuid": "4ee9d6b7-7cc6-497b-a451-4488e0e799da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "af41fed0-aaef-4d7c-ba53-43f5d63cb6d5", "value": "16b77ec1264f00283bd08b00a72d652f4c47835c35bc906d8ba0906cbd371eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dac18fa-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "854e8c6b-88cc-47d2-983e-b33fe4cf049c", "comment": "Malware payload (Vidar)", "value": "a03852c13e239a610a6f55903069e328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "5b7a6720-4919-4e72-8dbb-ff8419fe1c28", "comment": "Malware payload (Vidar)", "value": "16fa8f51c81b23a22433640d4a5e5280bd99b984fa14899987678596fa9c272d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "afd6c797-82bc-42a4-a818-ff1cbafb73ba", "comment": "Malware payload (Vidar)", "value": "f5b30939c25b1b38217fe6adc535917742dbe3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "f0b16c6a-4345-463e-83f1-4416d7081097", "comment": "Malware payload (Vidar)", "value": "21e9a1750a441ae8b7c838019b1d7bef96cd9b74ec683e26c766251cefebf5d639acaef560f55d4aa0dcb761662f1ee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "de223e3d-a7fd-4ee1-8bc1-4b1b5ef140e1", "value": "T1EF929746E11BAAE4C4D9C7336366526751FCB86022356B3B9FDCA93A4E42330E7502FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "a2713ae0-9759-41ec-8be1-cafef15ff605", "value": "a6c2466568aae347b94e75c85d9c3820", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "f7f66782-8550-4eef-b1cf-e882d636b2bc", "value": "384:OMFNkOUeiKHYpxgx0yIBOTaDVijHNg6KzFhq14Ur0K11KlsNDKYT1TCsCg:7rIxgx01OTKiNgHMMEGsNDKYT1TCsCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371028, "uuid": "6e3aada0-163e-42ef-a6bd-359b63152fbe", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371028, "uuid": "494ccad7-f623-47b5-be2d-0c1a610df535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "45503d97-272a-4705-a2df-1a0abbfe246c", "value": "16fa8f51c81b23a22433640d4a5e5280bd99b984fa14899987678596fa9c272d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fe0887-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786345908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "6b7b8b17-938a-4d22-94a4-8a095d8d04ab", "comment": "Malware payload", "value": "065986a4e27072462709eae186c20ab3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "f9c32bf1-c7e7-48c4-9eb1-56273a08f28d", "comment": "Malware payload", "value": "176b4609c03ed36488e941da7ce8fde7519eb0b3376f030c30114251a93ec85d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "bb7de28e-e819-4f83-acfc-b125e1d958e0", "comment": "Malware payload", "value": "9ad9e73a7c817b9b8492861232fd77af73c48c37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "0a8e1915-9220-446d-89e8-2905eba84df1", "comment": "Malware payload", "value": "5ac34a0eb99ef76681d03180a86dc64bb2811796f38f7ad5ff30421efbb4bc3344333e3d304027f22104ceabab4da78d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345908, "uuid": "d8200510-b604-4f7e-ac09-f03fdcdbd02c", "value": "T120C28D966A867C40BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345908, "uuid": "ccbc3d51-0d20-401f-a21a-fecbcc532c78", "value": "768:h8vCB+25j6es8R7x9FYpMSUpi+20qUpi+20YQX:h8l25J7nd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345908, "uuid": "95ca3f95-4315-411e-a9dd-f22a27bc9855", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345908, "uuid": "cd4b7fbc-52b8-462b-91a4-a98084311b04", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345908, "uuid": "3e01a6db-59ac-48ee-8a18-806729306258", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8f531f-9496-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786351030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "1bbb6c42-a839-4f23-98c0-d81a5ab690f8", "comment": "Malware payload", "value": "bbd8bf0f75f7ae3d321656b5ed52fd66", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "b6c8cab3-993d-4989-8e36-5cac4c44028a", "comment": "Malware payload", "value": "178528e57e2f085bd6d3d7c3835dfb02658c744d6cde82c1eedd606e16d1815c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "4a5bc7f9-10ee-4b59-b5c0-5ff58ba443ca", "comment": "Malware payload", "value": "ebbe5ebff2ec8c79ccda033e157433d1542d2895", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "b2676cf1-905e-4026-b209-1fc7161eec7f", "comment": "Malware payload", "value": "a89a7963adad06ad341feb777d2fd0c3bf2c6581abf2617e3751132a8d4e2cc17366cea300dd45b1c7d8e7bf11bae21f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351030, "uuid": "fec14ac6-ebe1-4843-b469-f78591885290", "value": "T1884423CCBF280353C5CE4BB069371776127D6A22E556556C2BC288C78E593F320EE9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351030, "uuid": "77c98fba-b6ab-4406-9aa7-178e783801bb", "value": "6144:7mWti6kB/2A/KR//6Tq7YA8O/ugfJDLEWXmm3GqonT/0pGn:7mg22AIKm7Y8JJIq2T/0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786351030, "uuid": "7a3f30d9-c122-4913-920c-aadb257aebfd", "value": 274012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786351030, "uuid": "e71946c7-05f1-4b8a-957d-72bdd14acdd9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351030, "uuid": "d860fccc-c320-477c-8393-33d9bf9b630e", "value": "Hopeless.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d0769c-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "e3bc54e1-0b6d-426d-a4e9-312c6bfb7ffd", "comment": "Malware payload (AsyncRAT)", "value": "2d855f570a4f542ca7b32ae5f083b20f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "49cb82ce-094b-46a3-84d4-170d26dd3985", "comment": "Malware payload (AsyncRAT)", "value": "17ae3de683fef60af0d8533cc4a7f04d302846476377c40e324b98630d835364", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "b7120157-0eab-4899-8c85-ac05b82aa57e", "comment": "Malware payload (AsyncRAT)", "value": "68e3f0ade6da737bdca9db927c322bf6da6a3aa9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "dc433bae-46a2-48e8-b700-d68fcdf76d07", "comment": "Malware payload (AsyncRAT)", "value": "e9e7921c42e5c2854ae78fe7f6131f337b849f45a1dbcd93472e041a02ebc425d9b8b69c61542f88580ddf82d8f4d493", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "40a56cab-2aa5-4998-88f6-a2a3d5428d25", "value": "T11C1501447A09CA03DAA503B94A72FAF807BD2DA9E412E7174FD9BDEB7576F004D40683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "5706d459-2816-4d13-9621-d2517e6c2e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "1ff07bb3-6c7d-4c03-8746-c5e35afe582d", "value": "24576:JgeA9s4HavBK7YoE9pvl/RzTtNHciwWd+ceZ:bUs46v4coE9dT5Bve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374107, "uuid": "b5f6e237-9e56-4713-8e63-893cfe17caaa", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374107, "uuid": "119e3789-050a-4c30-b9c7-db17d87bccf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "b6743d5d-52d8-4567-b642-7f1ec03cb9ef", "value": "17ae3de683fef60af0d8533cc4a7f04d302846476377c40e324b98630d835364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acb702d-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "ba03e3de-a5cb-438d-8860-ae4b29cb2a39", "comment": "Malware payload (Vidar)", "value": "544482f7cc6c2368f454d66950bcc623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "cf288438-d6a0-44c1-9606-05bd7185761d", "comment": "Malware payload (Vidar)", "value": "17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "317ce66b-6f51-4fa3-adf5-29cefb6a3c59", "comment": "Malware payload (Vidar)", "value": "71db7a8f1bb2a5cbebd279f98ba8d6a34e9a3226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "0b4f618c-4a4e-4096-b19c-fb92c9cc2851", "comment": "Malware payload (Vidar)", "value": "ca244e494ce77f8f2a3b01e66794eabec3b4893e8a5da4be1bcc1f40addd3c346de5e4cef5fb2b2146d295b76d3bad00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "c5b805da-abbb-4288-a466-b1fa8a028833", "value": "T1BE520A86B0C330F9C43AC379D74653A3DAB6707812394BFF6BDDA5691E619103EA8748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "d7b1a64e-8303-4278-8592-30e948561662", "value": "258d7cca1a45fc76d070b638c4790e6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "4517f47f-a1ad-48ab-9a9f-432b647f85dd", "value": "192:OjhXcb6jS/puejOZSi7YMTvcxflOksV4WUw5reCw6CG69fZmDVvTRtTt4D8M7mtG:Oj3D4uksiWUsqCw6CG6+Vt4gMZa9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371936, "uuid": "940fca4d-f229-4c98-8b1a-ad43207c0c1f", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371936, "uuid": "cbbe86c1-d1c9-43a3-9192-1fad985c541a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "a03a4b0d-b3d6-4d7d-986d-9b193c425828", "value": "17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4ecbbd-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786368474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "581ca5c8-99f4-4f17-877d-169c882f0d17", "comment": "Malware payload (njrat)", "value": "ea9d1eb976a0c3f31af8135b1c866f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "69866ab4-b058-43c3-a1b6-ba827a2c4830", "comment": "Malware payload (njrat)", "value": "17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "d89b390e-b4eb-46b1-9e0c-00f007d5a859", "comment": "Malware payload (njrat)", "value": "50e41303205b2ded9f95435ad5fd2ef928fc1454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "7c2a0782-8832-4891-84e6-40eaa4f4f789", "comment": "Malware payload (njrat)", "value": "746cdfc031925632d72e5b8bc883ffcff6201277bc36ef7ce7ae772e5f21d1a6292907ae277a6997d7ca8e15eee01135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "51bcdc67-ffba-421d-bcc5-48614bede33c", "value": "T1E11501C03B39B71ADE5516349534EEB501FA2DA8B011F9E26EEC7B4B75AE200AD0CF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "2ba64b87-c6a7-435d-af54-8ed6990a967d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "ef7db2b4-9708-4606-9d19-8bafff6b10fa", "value": "24576:V1BaXrAQVIKQDTNDPNKWuJBuBpHESQDo/O1:VK0EIK85PNXuJBOHESV/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368474, "uuid": "2cedd302-e6ec-4972-9a21-41b025f0ee76", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368474, "uuid": "cf1f4ac9-da74-4bc9-81f8-35e1742c5d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "7901a185-9f79-4977-b665-f1802470ee07", "value": "17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c15ef1-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "078758b9-217e-46a7-b3a0-30ee876305e7", "comment": "Malware payload (PhantomStealer)", "value": "df9327fb180bd3622b2dfe7251687ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "b1391a51-c96c-4043-bcaf-d191302f74d2", "comment": "Malware payload (PhantomStealer)", "value": "18251c266fc7315dc0f437c1fdbcb71b6f65b776cd6bea7d3418d79fd47a1a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "8968c110-73af-4589-8e2d-982dfea573d9", "comment": "Malware payload (PhantomStealer)", "value": "cd941ada21580c2489007e70f3db294b3f1eb43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "6f662905-f21e-4833-991f-63bcb44fa191", "comment": "Malware payload (PhantomStealer)", "value": "ad891819ac62f9bf4d07627c14c17f91087a17ded5e3fe3de830160bf3804db59483ea3f048d7403a3e7d21be271092f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "be8db21e-4082-4440-a244-cd52ccf2b8fa", "value": "T167F4DF6873F85A00F1FF5BB294B59D51AB35B513A961D71E11C081C80E72B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "d4ace265-7ac8-4fe7-bf72-59c4bac5991c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "d6c00f3a-41f5-49fb-98df-34adfa011651", "value": "12288:H9qNWvkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabm3NUW6:H9BkqjVnlqud+/2P+ATAS/JYec3NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373186, "uuid": "e7dcc79c-cfd2-4e87-9dbb-854e600b9e97", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373186, "uuid": "5e2dd737-9d0c-4adc-8c5a-79989493957b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "25c058a7-a03f-416b-b4c2-0c367a34e597", "value": "18251c266fc7315dc0f437c1fdbcb71b6f65b776cd6bea7d3418d79fd47a1a97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1613ec-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "8f9026a1-b4b7-4ccb-b218-fd167199a547", "comment": "Malware payload (Vidar)", "value": "d36fbbe6610cd367229563c98128c47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "c0f44588-7360-46ed-8d0f-e87830fa8151", "comment": "Malware payload (Vidar)", "value": "182bd3eb390e7b4d4d4f36d73d40fa88d51384b099a22e27c09e71c72c19593c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "b7bc6bb7-9042-4091-815a-da94d43d83c7", "comment": "Malware payload (Vidar)", "value": "6d5b456a85978b8bf144a044106635a06a2b3142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "780d0397-48bf-41ee-9cb3-b9dc2c806a63", "comment": "Malware payload (Vidar)", "value": "ce13d02b2dc010a3312a64e48abbda249f354a6bc559b76a9b0781dcad351f0215523c759c6d2c70a1568c8ae4ac3c9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "ebb76376-bc56-4170-9ded-c019d3da4018", "value": "T1324209CE72D7B4FDC12AC6B9CE1F127B9B23709503164EBF82ED4994A7C16103A74914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "ccb65c2d-d299-4fb3-8c0b-02ee97a69e4b", "value": "e83ec31e160bc53e897e6b25acb9d1af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "4c7c6f42-4947-4b5a-b96e-db1e7516bcba", "value": "192:O6vr7SdmsSysdqdWvsRanfDVia5qeEKlRtQslGtLPg8q3QHf9v3VYTM4F:O6z+dmsSvdqdATDwmqelH2LPgnkfFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371076, "uuid": "00666527-956e-4db0-a7c2-a3a5968b6407", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371076, "uuid": "e18e6c2c-8eb9-496c-b297-91d62453db18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "79a84bf0-bc01-4c13-928e-c681f5be5e52", "value": "182bd3eb390e7b4d4d4f36d73d40fa88d51384b099a22e27c09e71c72c19593c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353b767b-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (PythonStealer)", "timestamp": 1786370585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "9fe3f676-b1af-4bcf-9829-d7ea28047ee1", "comment": "Malware payload (PythonStealer)", "value": "430626a11bb3eed673c5113a524c2145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "b3d10cda-c8b4-470a-9732-5b8c4a5eb844", "comment": "Malware payload (PythonStealer)", "value": "186c53235eb7dc530821c7266c3e973ec2d3d692380bb208481a9418ab728cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "bfbc0c7e-4020-4793-bf68-02224bc4f582", "comment": "Malware payload (PythonStealer)", "value": "b454461d1b8e3c7d64dbf050df4fa7aee9d6eadf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "7795a431-c630-48f2-b675-4d9b3d6973ed", "comment": "Malware payload (PythonStealer)", "value": "9a881fd7257d871c42d8a5e282a3a25373d16a5f64e3672b02a59cce6912b8e3b2d5e217e1afb071e20039eb399fa453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "347caf14-3f22-455c-b810-514baba468e6", "value": "T122763305C3A319ECC5DF90B0E69AADA0F1247DECA332D17357A087723B6BF6149253A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "5e5283ca-ee4b-4528-bf04-d280cd69d7c6", "value": "fc3b0de2e7f988c46ed9c8e46a804071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "3dc644ec-dda2-42d4-b7a2-26f7e0259b54", "value": "196608:LNlGu+OUFcKFUezvxY/fk8M8IIx6QlW/SV6jMXm9vnE:iF3Vv4f0LIFvAhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370585, "uuid": "fceda0fb-d43e-48b4-ad60-e59831ae05ce", "value": 7153664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370585, "uuid": "7f6b8b83-bfed-4ab2-99ed-a24f0f913390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "62574bed-4835-42f4-bd3b-1867489ef7bc", "value": "186c53235eb7dc530821c7266c3e973ec2d3d692380bb208481a9418ab728cd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72358f0c-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "46100384-ede2-423e-8ecb-1eb0981502f3", "comment": "Malware payload (Formbook)", "value": "152c69c61cbc5018939e456cb5e16b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "d2a132c5-ddc9-40bb-800c-561c11cb780e", "comment": "Malware payload (Formbook)", "value": "188c4b2e0362e9b5377e429dede079f8fdd80094cb9706a5fd826e3704f6bd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "aed88725-6eb6-44e7-a29b-a33c257d672a", "comment": "Malware payload (Formbook)", "value": "2d5c4b86ac0019b5575862200f511267787e44a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "b43be9ba-7355-4823-95c7-e7ec4802a8ae", "comment": "Malware payload (Formbook)", "value": "8796f183fcb95a8d138bd8f587d0b2a47e415eaaad3b36293434234b7a59e6a08e971a85728c5927a2ebbf250f171726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "7ed177a8-0ecf-4902-bdda-5102e93e3ae9", "value": "T144252249B70BE603C50527354BB2F27523AE9FE26803C22767DD7EDFB92AB199C40251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "09de715c-c653-4137-8ebc-852125b0aedf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "aafa862d-5c01-4379-9317-254a45bf1ff3", "value": "24576:FMX/oG1UWLgrtZYMy0tbQlfX42mb6/VOtM:FMvoG1UDZy0tEhUbyOtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371976, "uuid": "5fcca09a-c63c-4d2b-80df-5a5e0bc39894", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371976, "uuid": "576ea1ac-26df-489c-ade7-434a0adabbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "e5acdb9e-59a0-44ce-91c6-0b0858419f4f", "value": "188c4b2e0362e9b5377e429dede079f8fdd80094cb9706a5fd826e3704f6bd2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4a64b9-94f2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786390466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "62b33284-a43b-4543-b8c1-13a8d125b45d", "comment": "Malware payload", "value": "76bccab7973ea4e8d64d3dff84a1f64f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "662d1da4-88a4-4c36-9b3c-796c09f3eb96", "comment": "Malware payload", "value": "18c63349d94f99911879da995d0a1189a982311d15a2bea45bbe181bae2f8db5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "f521aa19-768a-490b-8398-f080b4651f74", "comment": "Malware payload", "value": "41644479ae3eca18562946d5f0f1bfba59ec4495", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "f3976df2-61d5-4e6e-93bc-5c2fd4917142", "comment": "Malware payload", "value": "be2d0688f19f2ac410ac66e28a91d7490ac831e5d280c94cf87165d7495e70256ccdd02a07f0c201a5d51765f7edd400", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390466, "uuid": "5e816560-1730-4a47-88dd-0b5d6c5f475c", "value": "T1A942F68CAF8063B4F29703DD77AF2999132561CB544CDC80F64C5DE06F4B78D4A56E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390466, "uuid": "5b7e406f-bf5d-416d-8d36-b96e64659f12", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzqlX42AiYOpzfMqY6Zl9CX:sXX+/DV7k/3qlLAiYOpzEYT9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390466, "uuid": "5e9d36b8-ea8d-4135-aeec-19293713f69c", "value": 12044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390466, "uuid": "7a4cf227-fd02-4eec-bcc2-dc968635a784", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390466, "uuid": "cd843451-1236-4345-91f7-ae99930f9d97", "value": "ttt.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb42ed7-9504-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786398218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "3c6c9d50-c16e-488e-a225-7b77536a2034", "comment": "Malware payload", "value": "f76fc5ef54234f4bc44ad169596b9444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "6bcb2b36-3bac-47d5-b65c-cc37410462e2", "comment": "Malware payload", "value": "18cb678157f4b65ed79a60bd50300f1f9894d36ad87434a1a13e231585e439ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "3ef3cc83-f610-447d-a1bf-661e9dc6c032", "comment": "Malware payload", "value": "611a471bcf705e6a9f80911dc97c092f4f7d3f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "fb964150-e2c8-46d6-b574-1c5c1a5f89e1", "comment": "Malware payload", "value": "1f56fc3a82f8013072f64fcd41227f93582e8507f48e60167368ec2239475ab40275b65bb5e73943da7d8ee335076cf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "b9fb3393-7e4c-4a32-bf1d-00ac64274b97", "value": "T19BD523DAA1B61974D023C776EFA2E07D716C7B985661CE4BF7CC69108C43288603E3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "a755e65a-2157-40e8-8140-e336792d8b27", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "b8f05cab-b540-4020-b09b-03a434cf46fc", "value": "49152:7IFb9DPOYQog1pWkDkqHiakxyGlt46AWIjLLAyHXr+KxVxTotoSvqBdNc7dbpO:0b9L3Xg1jV5kxyGlttAWIjL8mr+ruaOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786398218, "uuid": "981c22fd-1148-434d-ad82-50aeee59f07b", "value": 2894336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786398218, "uuid": "8f59d1ad-6b74-4741-bc20-aaba5a207d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "8957d80f-ba4e-4011-bed0-217a8633fb52", "value": "18cb678157f4b65ed79a60bd50300f1f9894d36ad87434a1a13e231585e439ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e7704e-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "ace41770-1244-4259-8239-778b633358c1", "comment": "Malware payload (Formbook)", "value": "9559e837bd0ca6ef8277ed2c2c4cbdf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "df125c5e-bb63-469b-9cc0-7be10293fc0a", "comment": "Malware payload (Formbook)", "value": "18db6ccd20d52de376dd642bb304674230ecbcdf3c911e4e0f2ca67f27c40fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "342c4fd1-0c53-4989-b727-f72100ce3d80", "comment": "Malware payload (Formbook)", "value": "49c6603a3c420123aa8231719441c53de3d366ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "ce508c2a-2401-4d6b-bb99-7b812684356a", "comment": "Malware payload (Formbook)", "value": "aa36cf9d096136f9f185cd5b1409a789569e0f78d783f20bef57a48b341110fc9a769404d377bb9f081e024855531cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "bcae6d5c-807a-4341-a7fc-8d3aafd35be8", "value": "T1C83512002A8ED801E0E7577594B0E73913F7BE5DA521C30B8FEE6EDB3A26B015D147A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "76c8035f-97b3-4fc3-9007-61d1a536afb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "0bfde0cb-d4e4-4f8d-8dd3-7f972a890017", "value": "24576:aY9q3cyWcWaXto7ub2hHHNZhaQreRrfuHSnpt8rAYDBuK5OXZiyylhG2:T03TrWaXG7Y2tHRa2eRrfZnpt8rACB+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370697, "uuid": "67e5c375-863e-4605-afaf-51f1da176466", "value": 1135616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370697, "uuid": "4d91125d-7f60-4b4a-8f31-10a33ccd206d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "5aa2f5f2-31a7-4bda-b0d6-9a8db095a177", "value": "18db6ccd20d52de376dd642bb304674230ecbcdf3c911e4e0f2ca67f27c40fed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7c1a26-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "ac8f3612-e52a-4d0d-bbbf-be8961ddc809", "comment": "Malware payload (Vidar)", "value": "33b47569f2a5d3740158ac490a377db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "7c584cd6-89cb-4ba1-b7b1-38ab850926b1", "comment": "Malware payload (Vidar)", "value": "18dc508590e07a34461a1d931167b6be9f3a44771c15583289c5547059a3ce12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "8f7e1094-686b-42bb-a6c5-87799ea930d0", "comment": "Malware payload (Vidar)", "value": "44da682acb2bfaf9da75e2c12bc6a3ffeaf51c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "89d5faf7-8d23-466e-87e3-7cac019593cf", "comment": "Malware payload (Vidar)", "value": "915c660c376e7f536b859b197b9f74bd91c4a3df3ca4bcb863fa5e9cfb47d2563c5b8f78709645a71683f2ef9941215c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "2732be30-6f26-49d7-a7ea-df19861a02ca", "value": "T1715219C2B2D3A0BAD428C37CDB9A16BFE67530851A1F6BFF06DC97542BC261522F8544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "caec2acd-fcb8-4b3a-93db-252ee6e546f0", "value": "11947076675cd2ccb7ede65c6ece700d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "3524a754-6bf5-435e-a182-846770a0ad47", "value": "384:O4iAVQhVq7EI7fyaEa5btGpsK7N3vmmoLlY+cR:sDGEI7fyaEVpP7N3emoJY+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370894, "uuid": "8e0c77de-f2af-4850-a20d-b57d1bbc0fe7", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370894, "uuid": "14753f7f-5760-41fb-8c70-45d6dcb510b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "3d39d9d1-d7aa-4a6b-ad08-d5e3a046f1f1", "value": "18dc508590e07a34461a1d931167b6be9f3a44771c15583289c5547059a3ce12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad89723-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "bc455cf1-9517-4f4a-970e-b28a71aa8459", "comment": "Malware payload (Formbook)", "value": "af8c7bd23a3302f1f6e332895f377b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "2bf8e053-1260-471d-84fb-22eba0ce2044", "comment": "Malware payload (Formbook)", "value": "18f6d316d88055a24c76b9a548ed4510819228c9fca2b3ba681a5c4a0e63ff08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "0a6638c2-108a-413c-97f0-b94de6c070a6", "comment": "Malware payload (Formbook)", "value": "1b417ef660c5a2403c2dcd85b889ddc00d449854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "df468b10-d1b9-4573-a771-fd16df1bccbb", "comment": "Malware payload (Formbook)", "value": "00bdf9e3cecbca2a2c9808bbd6dad44885a903bdf05d339ebd97b2f1daa7c03d9d85ac62e7364221bd542c611f50c0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "e5f3ce5f-80c9-4d39-b901-e55b9387bd35", "value": "T19D3501591316D911D0D687F6B8B0E33132741EDF79E3D2D29FEA6FF738682812964282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "dd4f94ef-31d0-4a17-9281-a4253768e223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "dd622b73-9dd3-4f4a-8ae5-dc50d011a0f0", "value": "24576:Dp5028UeQnIEQqiwhceCleE06TIOmXReb64wMAY:DpNfIEQwcxev/Ib64Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373332, "uuid": "31dab52e-762c-46ea-8ae6-a068fa94f0cc", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373332, "uuid": "55e3e972-ce4f-4218-bb17-8952e848e550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "4cca4948-050b-47a6-99c3-8d3a081bd296", "value": "18f6d316d88055a24c76b9a548ed4510819228c9fca2b3ba681a5c4a0e63ff08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7714be-9508-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786400021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "5116470c-b39c-40d3-8cc0-0208c8491588", "comment": "Malware payload", "value": "9144b289cac323da28e0d128723bb2be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "3a51672a-0828-4d08-a098-87d1149652d8", "comment": "Malware payload", "value": "1904d30ecdb622d1e657e56973578d062e4f109c4e9913a6f6fd47eed34283ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "d889fff3-b40f-46f7-8616-ba0bb32081d2", "comment": "Malware payload", "value": "5ca5c557834649e2164e595f2de44a66924bf556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "a349fb96-7c56-4835-a35a-9bd92b812bf0", "comment": "Malware payload", "value": "9d69e75beeed8469ccfd16406d1373bc2754e118193b68e059cf8d8787e9cce43fa4945afdfe039784a9d66af0b3b031", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786400021, "uuid": "c759397c-486e-4975-a8f3-18240a02da9d", "value": "T10ED33B13FB0C0563C8936DB81E3F07E983656D9210FED115260D7AAA1B33F71A687B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786400021, "uuid": "9375047a-8f2e-431d-97f3-6c2ec9696c65", "value": "1536:kDWz5jYd1EkPIDTppqzMJD6IwxmvjowjqG9eDx4SsubbmCqZxW5Qv8rTc4:kSz5jY0BDtp1ymrow+G2BbmzWQUTc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786400021, "uuid": "33a0a3c4-659d-4001-86bb-e26638b9713e", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786400021, "uuid": "9ffc60a5-4a87-4dd7-ae32-40b06f2b0a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786400021, "uuid": "2601fe81-29b8-4a55-a255-c890147ab68d", "value": "1904d30ecdb622d1e657e56973578d062e4f109c4e9913a6f6fd47eed34283ad.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71865e2-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "7548f679-737d-4f59-a194-ce2713fdf948", "comment": "Malware payload (Vidar)", "value": "7337beff9e8343be14d7d4b45945c513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "f322731b-cd49-4b1b-8436-34180acafa1c", "comment": "Malware payload (Vidar)", "value": "197fb13ceb2d68b830d514e9c5e425b6c6113a3866bf29dcd64b7cac5d8e49ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "f94f695a-a1d5-4b14-8831-d3685a37cacb", "comment": "Malware payload (Vidar)", "value": "83f2010e3b4dd20897a840d344ee08d534d6baa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "37957670-ca3e-491b-b268-e134332aa763", "comment": "Malware payload (Vidar)", "value": "29c272fdbe7494e8feb54c13a994df9410a9d8929a6250aa0bcb72027947241e4de3da10351f96d3dcec5e0cdaac4429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "20519f67-309a-48ad-8ebf-6822e5031267", "value": "T1335209CB7193B178D16D873ADEAB66B7C727308513260ABF57ECC68026C3612747CA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "36d4317d-8aff-4fde-9593-64fad0397760", "value": "05e6b80baad8cf4ab7984ab97f66f3dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "0174d2a7-e0a6-4603-9195-de47abfecf1a", "value": "384:O/frbs83MXiTwXsRjpxea3IayIwlBfDZ:0rI83CowKjpxezaBmlDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368279, "uuid": "0f6fa86c-4230-4d11-b6bb-2ac7ae7b5d9c", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368279, "uuid": "9430d646-0438-4b00-af9a-ef2bcb21ef15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "5062233f-1a80-4acd-ab5c-3b9899edc026", "value": "197fb13ceb2d68b830d514e9c5e425b6c6113a3866bf29dcd64b7cac5d8e49ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d611c3-9476-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786337028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "16a5dcd5-100e-42c1-bde5-abcb4d1efdc0", "comment": "Malware payload", "value": "eb842f508ddc0bd5fce98846bdec224d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "dc83f671-2a79-4a25-9851-3618a8414dbc", "comment": "Malware payload", "value": "19cb6e2c780df2cc64423ef5fd65dca77d3863eff4f2d8efd66c0f31d152764f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "5133227b-7486-4c10-84ee-383eda6fb014", "comment": "Malware payload", "value": "7f0f2291030cebff26e66f2ce9864cb46d6a72b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "d328c401-4078-418e-8662-0192739b7b34", "comment": "Malware payload", "value": "f4cd56b106250cb92b9bd6f56a06f3053494d2861cf02afcca224a65071878afa1adbe20e0b545c6275fef9bb006889a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337028, "uuid": "01b366ef-48ba-4183-bda8-b39524c3d686", "value": "T12DC43AD4F2C55D7DF00619325FC3DB16E6126ED2E3685BAE892507492C8CBEBCF22168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337028, "uuid": "22776e40-2099-49a4-acd2-8039b98b2c2c", "value": "6144:EJSkZt0J7wxSRRbZpAuneYMvzq0Sj7mgwQOsCOUyW7vt9q3/kTKVQp3q3DO:EAg43ZMLqpiQOVOnWb2XQp3q3DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786337028, "uuid": "21a63ff4-2aab-4a61-b245-6b5c093f2dcf", "value": 562884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786337028, "uuid": "5ec02e8c-789a-4fbe-ba4f-0156728559b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337028, "uuid": "b52f005f-60cf-42ad-8f66-5d6f1355caa1", "value": "main.nios2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6190fe92-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "54444650-bf48-44c7-a14f-09808ddc2978", "comment": "Malware payload (Vidar)", "value": "6f0e024d042531f68bbf554656f8855c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "e6ae5ec7-3f94-4edc-a402-85ca6f9abcbb", "comment": "Malware payload (Vidar)", "value": "19ee6a79f7851b673c91d7ac6853a76829b7c3d66f0a7af1b0a43aad88fdecee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "87b03e1b-dd71-4ac9-ab9c-d00dc2f15206", "comment": "Malware payload (Vidar)", "value": "2b38eac176cdc038e1f2e89e6ccd4625e65961b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "9ba85eeb-525c-4611-91ed-1658f53513b1", "comment": "Malware payload (Vidar)", "value": "10ce714f3e774380673abc58914e5f883ca48022a719d774f16d76d8dc77a380229ceafaefce7f1aa27931f928820920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "d78c996b-8159-46cd-9d6a-73554c4a3484", "value": "T1D552D796B0D302F9D5B8C379D60A0567EA767093073B6BFF0BDC94603A852603A74364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "7caf489c-c1c3-4690-b2d2-8f797e5dc724", "value": "f49ef95be1e666482f052b8d214cb3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "e5cba987-b7ae-4ac5-a019-f4460237cf0c", "value": "192:gxnLxQgHg0B9IL6DIrNMTG+VAG2I1sXbpOO8wXVZ3VOWV:YvyL6crNMrGG2XXboO7XflOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371089, "uuid": "2c481de6-dffd-40fb-baf2-cd6cfe39b2f3", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371089, "uuid": "31a016a8-6963-404c-a816-b8da18027d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "b8630dfc-ae88-42fa-b5db-9fcf7d0df65f", "value": "19ee6a79f7851b673c91d7ac6853a76829b7c3d66f0a7af1b0a43aad88fdecee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2ad813-9485-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "234add55-fe6f-4697-b1cf-2c17feb28dc2", "comment": "Malware payload", "value": "3bb2f3b5aec84b755c5fb1d996fc28a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "32471f55-7c58-47a1-bdfc-8ab5056809df", "comment": "Malware payload", "value": "19ff2820e84060a73ce380673e13b75e65a087d74de2cd7d948be72c2ede0e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "3134f2a3-e61a-4170-81dc-24c57dc0644e", "comment": "Malware payload", "value": "7aa2945acc01baddcec712edde277c1f1434786c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "c7d592ed-d4f5-4169-910f-299648673227", "comment": "Malware payload", "value": "e46e0ac33154635faff47584f26d4a0ae079f01d529f8f763b162d451d37f0f8cdfb41670a25c620b447f2cd051dd255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343481, "uuid": "3d58f609-0acd-49ca-84e0-22da04e5c4a2", "value": "T1DF23E794F940DB25C7D074BAFA5E42DD33130FA8E2E631159E216B313BF79194A3BA12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343481, "uuid": "86a72404-41f1-4f17-9423-c6ab81082bb0", "value": "768:AdqOBWr03ntirEINhPhrXeXsLt3F7PNRsLTH5DOfhwqVqnFtbO+OAOnOx576qVJq:AdqKWr0ntCEINhPhrXeXsR3FTLETQ9qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343481, "uuid": "071f7d77-b78a-4fac-bdae-8ff52509a5de", "value": 45960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343481, "uuid": "dde8b7b0-202b-4a2b-aaa5-ac075556c7f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343481, "uuid": "d0d6ae25-3c81-40c4-ae12-be9313cac6df", "value": "main.armv5-eabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7e2a5b-946c-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786332852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "836046e9-f3a1-40a3-94dd-c66a69091ed4", "comment": "Malware payload (CoinMiner)", "value": "0a77c05a1540d82470fa49ed3932b282", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "c63682e7-ff4a-417c-b939-9a2cd4742899", "comment": "Malware payload (CoinMiner)", "value": "1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "89dc5de7-250b-43d6-aab5-199d4f6351bd", "comment": "Malware payload (CoinMiner)", "value": "c191cc112ee0c4e332ab2a97378ed36a3975c076", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "779791f0-4799-4430-834a-71d35e0e9d05", "comment": "Malware payload (CoinMiner)", "value": "ac47fc3b42f7d5cfb536347e30fa8cccf323523c6e447a08e7e9a69f2045a8bdde7076629971abc8fa00ce4f7fc7016b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "8fe3950d-20db-4e62-b9a2-50186be0a09c", "value": "T1B8363315F8C2D4B1C41AD7B88613B0AEB37F77A9A9B47C1B33CC69104E65E2A647E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "81e5cb6d-d4b5-4d55-951e-1b99866bde94", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "9c90c003-75c4-4e17-b55f-ada5c9afdd89", "value": "98304:9YlLtunCI0FyF8+cirXTH3CTt2mjr5wzvFHndc+vsM9pIkfPTb8DkTv+j+:8Lt28+c8THSB2nN7seb/8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786332852, "uuid": "a7621a2a-9731-458f-963b-b6cfa0082ae9", "value": 5287424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786332852, "uuid": "5fb7a51a-7630-4c5c-92a5-373a6b8a849d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "ae50228c-7d1a-4cca-9bbe-230844c2c2d8", "value": "1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d79b84-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "090d8ae0-d75a-454c-bb7c-2d7232838539", "comment": "Malware payload", "value": "6fa81b7421184da4fff923482cc2b067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "dd9fc69a-536a-458d-9149-009e72c1cbc7", "comment": "Malware payload", "value": "1a5661237d36a52d2310a32783ba23769c806bfec31524799ae16dac0f6c3b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "69659182-4f9d-45dc-a1e4-c7d795df312f", "comment": "Malware payload", "value": "c4885bb743d5eace9c21d0b3b4eedef8dc3a476b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "e799006a-b20c-4629-b35d-d39abfba9866", "comment": "Malware payload", "value": "fd657fe07d31da19f12236ffd00e98ae14e18185029ae21ce13375ce60c766726f8f20f698e0c98f1c1316e3cc3b23f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "e787c152-9e6d-46f8-bcda-cbfc6da2106a", "value": "T103E57D07FCA118F6D0AAA3318A36A9527B21BC481B3123D76F50F6B82F72BD05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "8fdc1aa0-b3c6-4031-aa61-837bbb78d0ad", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "9fe384f9-5125-440a-a3c5-f53c98b5a2ef", "value": "49152:Xf1Zj7Z2kU34kRTQa5agYVFTpJtYkMQwQuOchgOgnH4eQlY4ei:Xf/9s37TCPX4eQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373114, "uuid": "a1753492-75fa-4eb5-8f43-225bc9ed6f3d", "value": 3164672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373114, "uuid": "cc44fec4-7c72-49fb-a68a-d6c6d60729f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "566971f3-fc49-495e-926e-e2201c3fe338", "value": "1a5661237d36a52d2310a32783ba23769c806bfec31524799ae16dac0f6c3b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c6383b-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "a04e3325-52f0-474c-8ccc-0105e50ce5e1", "comment": "Malware payload (Mirai)", "value": "aa8424e342f411d1c2341f42bb3724b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "1de1f05a-b54e-4ddb-a542-c989e14ccaed", "comment": "Malware payload (Mirai)", "value": "1aaf6b6ffe1846391f1157490ae916e2006bf2248df0fb1573c8c5c7ff5c013c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "efd90ce4-dbc8-4394-beb3-530daedcfdf5", "comment": "Malware payload (Mirai)", "value": "6d42b6c65bc737463714d42105ceec5118b23fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "2f06c389-becb-4dae-9b95-db548fe0c5b8", "comment": "Malware payload (Mirai)", "value": "a67698c825ba8e0bb67a74650b9514eb3524d3e5aee55462558b161abddfe3ccf104fb87719bf265c902dfa9f6e37394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353815, "uuid": "0681a77f-07b1-428f-b2c1-78d1b6ac5774", "value": "T1B534C7067BA19EF7C89FDD3302E6860110CEF45722A56B6B7374D61CBA0A94F49D3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353815, "uuid": "36323362-7284-4c77-bf6a-310ed938aa0d", "value": "6144:SXnBrFB10H6110xN/58WzvgreG3Ai/a9vNYzpWe:ErbIc1ORzvgreG3Ai/a9vNYzpWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353815, "uuid": "bab7654f-43ad-42e8-a090-da73367896e5", "value": 238414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353815, "uuid": "8012a5b7-4b6a-411e-a6d1-261ef8fba543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353815, "uuid": "f2a5396d-9ab1-486d-bd11-912879c18287", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e86caa8-94b2-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786362869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "f0cc2c86-c6f6-49ca-bb01-a5637d7f8efc", "comment": "Malware payload (AgentTesla)", "value": "26fb1c9c1e679c743f2d493c0a889bbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "2478bda7-c0e6-409f-9870-e7b2c4fd0e55", "comment": "Malware payload (AgentTesla)", "value": "1b341c92a2bc3e9081b16d2b2521d3b6415fd6d717c066593a172daf2885cf7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "aeeffcb0-fdb4-4a7e-9cc3-995fe2345af4", "comment": "Malware payload (AgentTesla)", "value": "47c3720a608083c6916ddd393beaca77e302b183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "5c3c0ea1-5201-4508-a357-6bd69fe7111c", "comment": "Malware payload (AgentTesla)", "value": "ce2ca5062bfc63e3bf8b73ab8a5b79e5f368971bb2826ea68c6d62a46780dd8c0d6ecc1df1539cf5ba5eeb141f2de302", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362869, "uuid": "e339ea7f-632a-44b0-af6e-f53719d1a2dd", "value": "T17CE53CA056087BB0AA3D672ED4276F080F2EF10BD254FE1F367C564477A675B22CD8A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362869, "uuid": "79ff014c-5137-4521-982b-ee6ae6cc82c2", "value": "49152:MGURS3nAph9sNeSQxwowW9MbacWX6+TXZBf97xdaB0KbnXxYgE/nBGNh62crh7:MGURS3n4h9pJw6MqZBf97xdaCKzXxYgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786362869, "uuid": "1d19cdea-b175-4ef1-bf42-e73309451bf6", "value": 3041778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786362869, "uuid": "796b543a-6868-47e0-a89d-77ca0009a9eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362869, "uuid": "7fbb12b2-fd11-468b-910b-70c25a283c74", "value": "Quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b0ac15-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "19bac9b9-5262-490e-a255-894e29cff339", "comment": "Malware payload", "value": "22d1b589a4daf4d6723d1a10e7db5e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "ea916151-83a7-4894-8c67-09d4ad4cbe98", "comment": "Malware payload", "value": "1ba36565e2e25ab56db7eb706f8797667dab1cd6c0983a889c626dd00467a555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "8f295b53-1cb2-4c42-9365-a16ed1438bfc", "comment": "Malware payload", "value": "68f7dcd871ad09944f62c392bc24821ba7933dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "8217ca7a-a5da-41a2-8b86-f5487aa84232", "comment": "Malware payload", "value": "269b18d568456643faff4a3590ad45ce258cc4d68a1eeedfd7782c1a4a7e4862999e86be86430ef34d0dc0e87dbf6651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "e2481840-8db9-49e7-bc4e-506c107791c8", "value": "T1A545DFE06F419554D87F0B78803658A777B2E60E9EA8C60E3ED9BE5B7E73341841384B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "7636e260-d380-410e-a7eb-dc1ec6f1e9af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "dad99601-1ebc-4d21-bd9a-19ba1de3ad24", "value": "24576:z9+9qqigNf0NSIXtbJXsFxWbyIfE4uW/nz1K/kNQbA:paqP200IpJXixWbyIiW/82QbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369487, "uuid": "ba17f96a-0c30-4488-b7d5-6945b3fab2ca", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369487, "uuid": "555c7e8d-7694-4971-a7db-109352fe948d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "c205611f-2a11-4ec3-a717-d4a1f214737f", "value": "1ba36565e2e25ab56db7eb706f8797667dab1cd6c0983a889c626dd00467a555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a9a9d0-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "d2611076-8bf8-44ec-be52-5a2798fc6874", "comment": "Malware payload (RemcosRAT)", "value": "95e1530f164b5a9a911ee3ba2834b132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "dbd76684-1755-4890-b21c-bc43d009eca9", "comment": "Malware payload (RemcosRAT)", "value": "1bd4cb378ee5a101189665072f5d4999d76d336c2887c217e6be6cc0a924c84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "9b782ce1-28a7-42ca-8bba-6453865fdd95", "comment": "Malware payload (RemcosRAT)", "value": "e6b0191a4f933f5f500427adae2900a8765d8eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "0b6397c9-3d34-4d6f-ab51-ab5bd1b62ca6", "comment": "Malware payload (RemcosRAT)", "value": "ea992941b5d347ce3b1bb8b0f1fc55c65acaec659c561e0ab16094555dc6c62fd3daf99fc78a3ba07aecb3b0fd5b93a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "3f73a613-add7-4e76-8f8a-ba74923cef0f", "value": "T11315F1552317D842E0D59BBAF9E0D37433609ECEB9D3C39A5EE92FB7392A3C15980181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "102d816a-3541-42bc-8b50-84409f08aa54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "14bff2a2-b63c-474a-b3ef-8773b0cb4479", "value": "24576:WHp50jAmPLRgXxSKxiE8KPjYS3KxsHH/x+I7o:wpiAmDRkxtcZKbYS3KxsHfxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372681, "uuid": "5934ed94-2a0d-40b2-9967-07f92627a430", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372681, "uuid": "c13fefa2-d498-4603-819a-64ea9383ca1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "b34d6053-e07a-4130-8fdd-b7ee717593f5", "value": "1bd4cb378ee5a101189665072f5d4999d76d336c2887c217e6be6cc0a924c84d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbfdbcb-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "efe3c3cc-0868-4e43-bd11-d06f2b2dce13", "comment": "Malware payload (Formbook)", "value": "3a2dc6669b64c994a8872eaa41658aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "8eeaaf46-4007-4449-a731-f9489f021383", "comment": "Malware payload (Formbook)", "value": "1c3b5acda06dccd8c35aba56132af62daa376e01daf7d3c1a34e6c04284139f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "64a988eb-7250-4a6e-a546-652c155ff641", "comment": "Malware payload (Formbook)", "value": "3278b18cb938e386ce4bca738f9bd012d8998c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "8d5b9608-e030-43bb-a232-e589d4e0e3c9", "comment": "Malware payload (Formbook)", "value": "e1ede9679c9056e6719f9ca4f2c5151ccdc4d274f54b9249922b63594eacd989f5d1f53874ea17b0f718778a8dbdbb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "93c9ec87-bebc-43b6-af31-ead4fa3fe787", "value": "T1FD350208176ED806D4930FB19A71D3F816B69E68E822C3439EFEBCE7757AB467404790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "12617b34-a5df-4ba8-a8d9-250e4ad6a46b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "7279bcd3-fa5a-45a6-98b5-49e846bea7be", "value": "24576:rZkYeJaOEzcb/u9HJZ2WbfuEDm4RhtVeiHqEPvU6skB:rZgpEzcb/kpZ2QWEy4RrVe8TPvGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369203, "uuid": "56a6006b-495e-44ff-837c-02a0a2195c28", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369203, "uuid": "6644a02a-7fbf-41fd-b8bf-159f97dd38ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "2352fe16-db65-43bb-8861-fb70fff8788a", "value": "1c3b5acda06dccd8c35aba56132af62daa376e01daf7d3c1a34e6c04284139f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25399c28-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "0cb37e7a-b880-4362-a545-1b1b7df43dfc", "comment": "Malware payload (Mirai)", "value": "0a80cef93a3421685f26fbeffefbfcdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "90cfa1c5-26ca-4ad0-a509-0e5ee36365c6", "comment": "Malware payload (Mirai)", "value": "1cd0ec8c67c386bb7358233aea9fb91daf4a71ada0ccd21d52ef4d828244ddb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "e42c60df-ce25-4974-b93e-8612e11bfbaf", "comment": "Malware payload (Mirai)", "value": "aca0745f70553e619cf0875e160d4e9caaa0dae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "30c148e6-7a90-4ad8-bd30-5173e1d3af01", "comment": "Malware payload (Mirai)", "value": "f310c7fff87ebf747040e7e46e9cc22255a5ac4c175a4096ac795b400a214641328354b62c03c9aa5dc76de837af22f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340064, "uuid": "e1826e36-52e0-4c4c-b7dd-ed5c12cd4874", "value": "T1F8842C48A1F1E3EDE164E570531DBE169C7146333093728AF39EB97363A71804AEDA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340064, "uuid": "c906a60a-dda1-45f7-84d7-4afd84374a09", "value": "6144:lqeba933pJzdgqSnoBuVDeQblIki0HJIg+1tB/drGuGM99:lqeba933pE/nyu/blIki0HF+PBUxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340064, "uuid": "f7292409-4ac5-4f66-95a8-884d1cef293d", "value": 380292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340064, "uuid": "f4bf90fd-4657-4e02-8802-15c4de7b7aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340064, "uuid": "69ccb6d9-dfd2-4f63-996d-b1f539de9a9c", "value": "vlxx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eade1c0b-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1786373896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "b723281c-4e97-4d02-b834-cdd35cecd5bf", "comment": "Malware payload (SnakeKeylogger)", "value": "06100be196a549d76eea4e5bf1df106e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "b9cce1a4-eae1-4e9e-aa32-6e8603c69490", "comment": "Malware payload (SnakeKeylogger)", "value": "1ce77218079adad6c0a97c6bc72508e97c1d22cc35047e70bd52d5ef9c134601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "1f29b132-8e51-4291-9e14-7236d8aa0951", "comment": "Malware payload (SnakeKeylogger)", "value": "3d190c025bfa59d15a16060bbc680defd2bd747b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "d148c74f-1916-4650-bbf7-dbd6f165c5fd", "comment": "Malware payload (SnakeKeylogger)", "value": "a1b88a11641bc819fc674bcc49a158e9b5a2a4214289d768551508d8c5e33530983028ff8be70fc46609593a8e3af4d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "6d5d6bc3-d855-4f34-b34d-982a43b48fc9", "value": "T1D425231E97A69716F46A4FF54628E63113F6DC8EA330E30A9FC82DEB79537244A05343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "e1998bb5-23eb-42a3-9ca6-0732960bba72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "fb5bebdf-7022-4a9e-9939-cf343f74a14f", "value": "24576:wFVssr77K61LrU/qoEYGo53cIULJabbsNT948JNT0XOyTK1P+:wFZ7BUFz5sJFEbi948EpTGP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373896, "uuid": "0b03f359-93dc-4e29-8c9f-1f87ebf453db", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373896, "uuid": "d3a6be39-8d6e-4bdd-ae8e-c85b6d9450f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "116cbd59-0a02-48fc-856b-b626181a82b7", "value": "1ce77218079adad6c0a97c6bc72508e97c1d22cc35047e70bd52d5ef9c134601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cad9995-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786355592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "ead4816e-0c15-4766-a879-a6aa1f8c31a5", "comment": "Malware payload (Vidar)", "value": "48d66a8f0f2a7d144cfa1f6b7a006c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "16e74cd5-a65f-4588-9dda-07d12b33c830", "comment": "Malware payload (Vidar)", "value": "1d60903c4cf77503ae2ccbc0e1f33e455033bca93d1a289531df7e1a166a5449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "3ed6b918-bfea-4b77-a38d-0763e4beb766", "comment": "Malware payload (Vidar)", "value": "b267d67a00e870fe7f6b2b595842231ddace2657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "d1261290-2556-4ce7-9614-7e72c72cc6a9", "comment": "Malware payload (Vidar)", "value": "12db7df9a35c90b1937abbfa7aa63b4a205848629aa62d0cea6d0b7b07b3321289da25f5cf94ffcf3bd98057304ab656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "fc0ff38a-2eed-488d-961a-12df21fbb727", "value": "T1D7068C03ACA189F6C099B73188B79252BB71B8085B3527D72E61BFB82F723D05D36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "df80a13e-bb44-4c24-bee2-9ec8dcbdfe24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "134f6329-1d27-4b50-8e4e-18e0deb5dedc", "value": "49152:PzAYhHUjjTzdu7fjboLmZuJ+OTjtI5nSBPfC01/xPdJuL1Yz3M:Pz3bjjboLmZuJ6pP6aqz3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355592, "uuid": "6f4e5c25-1d43-4bdf-9fb8-7be86c657ec7", "value": 3987824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355592, "uuid": "cb1b8337-ca3a-48e5-b361-966d9d8e6c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "81ea764f-3201-4684-95fe-a87dfb842139", "value": "48d66a8f0f2a7d144cfa1f6b7a006c69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20dc74f-94ec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786387974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "3ddf9f52-8afa-4242-9cbf-add0a57e48b9", "comment": "Malware payload", "value": "ac3ce3e97631785fb13893a2a9d600a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "a7faead6-d74b-4bd9-962c-ed836031872f", "comment": "Malware payload", "value": "1d7be0eb2f6771b7a71b9eae3054eaa7a30467b68503c68ce29b50629e0b90c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "16c0adab-80ab-4a0f-83c0-7b768c18d6a0", "comment": "Malware payload", "value": "4aeba1ed14946362724775399ea2a68a19b57efe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "f9fce342-4f2c-4103-84df-41ccc2818ecc", "comment": "Malware payload", "value": "7f85384ef19af32fa94c2a9baf9c88ec3c886d0c8f576072f95556ced5dea760c8d43278cfb4d132375399e76a9d7295", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "5d1e55d6-2054-406f-bb43-a01a6915488a", "value": "T190266B03BE9148FAC0A5E73589B74252BA75BC4C4B3133D72E60AAB42F763D16E34B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "3c65214e-91f9-41ec-abb8-eb4847e1e1c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "b66a4ee4-613b-4c92-8fee-6e6de2883756", "value": "49152:Ec7NgkdiWps0rzLXpk2MP5/3C4jmTD+s+YeGn8yJXCapAFKj:EyppkztfsgU8ytpXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786387974, "uuid": "690e0c78-c75a-45e8-ac38-fb4ef330ff10", "value": 4820848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786387974, "uuid": "7df2bb79-d24d-4d64-85b7-a05af12872fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "cdcfafdf-d266-4dbc-b42f-15d8949dc06b", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe7b2fa-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "656ecb46-7e05-45e0-b50a-51c7c3cb31f1", "comment": "Malware payload (Vidar)", "value": "0f17b8e4fbb02459aaa5297a1881eafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "325939e6-9fa9-42b6-be98-0e0a36ac7e0c", "comment": "Malware payload (Vidar)", "value": "1dd7ee0dadf5fef422678d9b00e4b78684c314c8d4effee2034a7724de095ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "3a1c2622-2d1a-49c1-bdb4-ae00528d56ae", "comment": "Malware payload (Vidar)", "value": "f77ed7c67a08a35eae8136f5fb955dfd45687df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "5ecb270d-ab22-46fd-b963-511e8e92a1fc", "comment": "Malware payload (Vidar)", "value": "590aac8679aa3de639fe1597ebcca07c434584020e0c005a2ec470ff9571898c6d617bb8400f79a3f1971ababf4e8f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "0305b8cc-ab8c-4683-9282-069679f7c5cc", "value": "T1CF422983F1C5E4FCC1EDC37A8C2F16B69A1634885761A9BF76AD54542BC30A271BDE80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "2a7dfe86-f165-44ac-a35a-195e1e7ddedf", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "d9d66c26-9121-4b14-bc01-8415b8f37a51", "value": "192:O/I0gs4/wx5yk/9udxDFkXJiLVu5Y6ftpY13VjY:O/3gMxseudlOX4LVuLFcljY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371220, "uuid": "55f554e2-a49c-4c59-9f73-f5ff4dedd415", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371220, "uuid": "9bc602f3-a848-4c19-83b5-116d387bab93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "018f901c-dda3-47fb-80ab-b327347f5be8", "value": "1dd7ee0dadf5fef422678d9b00e4b78684c314c8d4effee2034a7724de095ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55603a4-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "5dc9af6e-6476-4605-9add-690ed0e2a442", "comment": "Malware payload (Formbook)", "value": "68434f9fd0d693ddcd31e7d978e1104e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "e26ea616-4400-48cc-8f30-9aabac86fc40", "comment": "Malware payload (Formbook)", "value": "1ddf551103612b97461daaa7f829bc13d87a8a817165b96f0bbfd8c8938c10fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "006aa962-a9d6-49a0-8cd8-53bcc197fed2", "comment": "Malware payload (Formbook)", "value": "241b49d8c361d43e9b4e6f9417ca63c79d21798f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "60d6cf75-3816-454e-9d9f-d0c53349d028", "comment": "Malware payload (Formbook)", "value": "e8d3dec69f30694199cd3ffa30f4e1ed63ad37e6f9a54665be5fc84e60c3030bd5796f1948ce5186b5a85b67eb83673e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "bd73814f-5323-4bfa-bbcc-2e2e89a4e9b4", "value": "T17125129497A4CF06E6E607F48961C2F403B81D9ED011E723CEE2BDEBB937791A454392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "0669f934-5df8-44c6-8113-37ceff9f413b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "9c852d73-0df2-413b-b40b-c5267035daf6", "value": "24576:pj/Og3tTo7o9aXhW3EbixNcycj6EVE4vzfhsLrN/xQuKsH:RPdEMVx0j6UrvzGN2J6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372142, "uuid": "ec6b7122-3c08-4e4a-bd58-5159d82c3f87", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372142, "uuid": "ca0ee84f-0abb-47b2-9688-aa6c54a488ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "742584c1-c3d3-4477-98e3-6cf1290ab73b", "value": "1ddf551103612b97461daaa7f829bc13d87a8a817165b96f0bbfd8c8938c10fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00e26cb-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "f61394f1-664b-49a1-a2d4-47f666ddc0cb", "comment": "Malware payload (AgentTesla)", "value": "ca940b5df9b59cb0e0dc0a36db4485a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "9018a7d7-0f9e-4ac8-8b23-a33bb9e3d96f", "comment": "Malware payload (AgentTesla)", "value": "1e2c86adb2a9f3853671bb85a3ac34d7e0c83861a9a735349c396986a15d99ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "ef8ae667-b11a-4610-9643-6f2d0189b266", "comment": "Malware payload (AgentTesla)", "value": "98e3218ed89a9f8f750c1935915c0f315ebc0910", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "a6b73b74-2dcb-4827-b331-1e0fc825db1a", "comment": "Malware payload (AgentTesla)", "value": "b43f2ecf817f0e5ac6933277e7cf9d36a023dde1b26ab6f03257895ef3f8241ecf79f004be0be43fc0f74f26d20a9b4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "7cb222c3-7214-434c-847e-47c74346bd4e", "value": "T13B45E136EE866295EE3D0778C427441823B0CD23D263DB2E3DE9F0F54B73254AA5B199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "4c11bcb8-f21e-4ed2-b5ce-415904a5c1ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "49e49695-0257-4792-a885-8adcf45b2420", "value": "24576:L2UxAPqGcv/+Duyx4KPMX+e4PXtvEj18pNh:jqPRcvEkWPX2j18nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371677, "uuid": "346eafd2-0250-4556-b44d-26abf73e47b9", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371677, "uuid": "7f5dd402-ccb5-4196-be7e-3fd89ca66e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "c10ce2b8-dd43-4bdd-be44-7dabe5aaa310", "value": "1e2c86adb2a9f3853671bb85a3ac34d7e0c83861a9a735349c396986a15d99ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32898be-950f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786403008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "9354e04b-7347-44a7-a4ca-633426dbd19f", "comment": "Malware payload", "value": "224b41af1717915304b30540473b8db2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "eea55cc2-778b-4aef-93d3-13f853a38930", "comment": "Malware payload", "value": "1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "8651ee3d-7ad4-468f-b113-7fdc91c373cd", "comment": "Malware payload", "value": "90d8371f9dcf69d9823549efb2de0cec384b7d98", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "f96845c1-e6d2-4eda-bc8d-7f8b68ab041a", "comment": "Malware payload", "value": "ddbb6e5ec939c78f9d87cd25fb1ee8d2e4c7a74e891a144b7d27970133da364c8505ba5a04aa84f9df6dc2ca23824137", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403008, "uuid": "f3dbb451-7625-4815-883a-736fa59d7ca1", "value": "T19D41126E74618E7033BDC8BC3885254C6797A66B48262F75B047783D27FC374B2683A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403008, "uuid": "c04dc67c-fd24-429f-8f89-0560c843e497", "value": "48:vkwvpihneZZn1oB1nDL2Y21j/EmfthmmDoht6GUskURMTCSgMul:vkwYheZZKLTujnFhmmn1o64d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786403008, "uuid": "7b9deb2c-29de-4467-aeba-b7c271e11a1d", "value": 2126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786403008, "uuid": "dc762386-9c72-476e-b0c5-44eec50213bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403008, "uuid": "ca934a77-ced3-4c98-9181-6ac322f61296", "value": "1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e947b88-94e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786385713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "4b14950f-26c4-4fdd-9f13-021b60551162", "comment": "Malware payload (WannaCry)", "value": "96e92d4e66e223a6adf571473d23ff55", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "31ab33bc-2702-4e49-9067-1fb67114242a", "comment": "Malware payload (WannaCry)", "value": "1e78e60de13290234f642709674835e7b400102d7d22367266fd38329782e58e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "e711f2d6-cf3e-46e0-b197-4c5c0a96a5bc", "comment": "Malware payload (WannaCry)", "value": "d52701a4ac5a141a3106efdc2b6b61a15167fee8", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "a1079fee-b08a-404a-ba03-ec4359d80448", "comment": "Malware payload (WannaCry)", "value": "2eaa9c750bb45ca9b99f2b457f016024379b9b08c256af4e495983aecee61de884c615c07d3ec194bec29ba620166cbf", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "8cdb6bcd-b01e-4421-8b51-87e1032233b4", "value": "T15936238D32BC81FCD00619B484B78E16F3B37C5A12FE5A0F5B548A7A1E53B55BB60B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "217f836a-b218-48eb-b898-db87a19b902a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "9976c88c-3683-446e-8b46-2a865800c33b", "value": "49152:jnsnsQqMkVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DM/qXhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385713, "uuid": "2d9eba41-f735-48f2-98f9-86d8bacf0c63", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385713, "uuid": "d5e6d012-7fbc-425d-9d58-edcc2ceeb45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "26766a9f-291a-4c8d-9dfe-ac9465faadef", "value": "1e78e60de13290234f642709674835e7b400102d7d22367266fd38329782e58e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9b63c7-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "3e08bcad-d6b8-427a-b6ad-167cb1fdac8e", "comment": "Malware payload", "value": "2becabfcc3249d04de7ad86696a08050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "8318fd9c-e01d-4dd0-b773-618745777724", "comment": "Malware payload", "value": "1eaf8ab730af5153c707239172f9c0deb417f929f9b596dcd2958d0e88043da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "47fae98f-7d01-457b-92b4-4f84b6a488e7", "comment": "Malware payload", "value": "5501fbe8f35b1c4d5045c6bfd70cab17d9763762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "c09d7390-9716-4d0a-ae4f-6347b1b86c7c", "comment": "Malware payload", "value": "869fc86a34796d9dff1a0d0b247602e4c1c9e02659cc6f44ad2617d2c30ab1d804d6fe1413b7c1203b8fba532974a983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368582, "uuid": "830587a9-d7e6-4a5e-83a3-38db37ffdbac", "value": "T1E2945B9477E54A06E2FF5FB4A4B20A5047B2F853AA27D74F09C590AC0E32795CE14FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368582, "uuid": "4f114f82-9550-4633-b419-5240c94e9471", "value": "6144:NMET8qCsVK7wOfhnjY89S8vjOrV15t5Gw5Gg/rcN6kgCmpXza9bIdbcD8zyc6uTu:qETPzt6hjYkS8un/5N4sCmpXxSBC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368582, "uuid": "23f909fb-8944-4ca1-a90a-d0ad9919456d", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368582, "uuid": "38259039-446c-4a76-8b48-8817aeafd3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368582, "uuid": "d027508f-5a33-4a8d-a3c5-3678d5ee0dae", "value": "1eaf8ab730af5153c707239172f9c0deb417f929f9b596dcd2958d0e88043da3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea0fa8a-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "75016ba9-fa88-46c0-a47f-38e4de7361bd", "comment": "Malware payload", "value": "f331adc29d2ff9e615955f2bf9485d23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "8129304f-29e5-4eae-9b5a-986830383ad8", "comment": "Malware payload", "value": "1eb0ee613f578746dde06048527eca9e397cd3569eec2e7800434af51a0258eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "7b81b2ae-4564-43b6-9aaf-eb0f8a4e3d49", "comment": "Malware payload", "value": "a56ffcddc6cccbccfe3d0e728e801b9f9c218fde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "aa0f5316-bcde-4b95-b3e0-ea38e2ba3fe4", "comment": "Malware payload", "value": "7feeb595cb084a2f34c0e7c9901caa59e131860207f647f1ef0ada00e932384127720d79b0c558b8d9d34f72aeb29cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330550, "uuid": "048974a0-0108-437c-9e0d-847115b69159", "value": "T19E63E907EA916AF7C41ECE70452DC24A11DA5CFE92E9511F71F8C98CBBBD3194AD3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330550, "uuid": "758294ba-fe57-4c2e-9df2-acd60439c0d9", "value": "768:6TiD5KnFvsxi3u8G7/iVI8L/EHaul+lSNj13JKnZjNnPYklu86aR48HGS:+iQnixp8uZ8wHaul+lSN5snZRrT6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330550, "uuid": "37ff97d0-ea5e-4454-ae54-8b3141c73c5f", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330550, "uuid": "748ae839-d27d-4821-b2df-fb54e4d1264e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330550, "uuid": "e3b3a681-4fef-4ddd-8e75-f84df4c95a82", "value": "main.mips32r5el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73e74a3-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "06df01d1-4aec-4ed5-a953-9f78b814e370", "comment": "Malware payload (Formbook)", "value": "ff86edfefe06e801bae2febedbdd9dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "f5c8c861-42e8-4a75-816d-1413e18b4a8f", "comment": "Malware payload (Formbook)", "value": "1ec67d002e59295ad714a05036165a091cfe97e5a7a3498186bdcc80df8e8038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "838f0c8a-9929-413d-958b-65d9e9b9a806", "comment": "Malware payload (Formbook)", "value": "94031fab82132fd26d61b8c49060a3b3f67d73ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "2df15db4-b8c1-43ac-9d02-a4b70efd65ef", "comment": "Malware payload (Formbook)", "value": "c486579eb998606190384d231b463661ae40148ae93d3b1874301a1354747861f5c547bcb87aa7bc18520b1fd31b8e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "5a0c0919-1fe5-46cf-8292-aa067d053303", "value": "T1752523A96619E61AC81153364F70F2B8277D5EEAB910D2169FE87CCF7E33F01AD40192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "9f8c5342-f4ce-4192-a0e4-7a91ef0a53da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "01807de4-e729-41ac-ace6-5b20aca83fdf", "value": "24576:3eB6p71YlmxarQs7oAqvEvK5fmboQtISZfl74dRX1PJ:fh1qmxls7mvE27QT74dRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371716, "uuid": "77139abe-ed3d-4859-8351-604e05d4e782", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371716, "uuid": "92d2bd09-0957-4c3d-a5ee-63264b4f004e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "ecbb6b2b-35ed-4e59-9f90-693a424d8009", "value": "1ec67d002e59295ad714a05036165a091cfe97e5a7a3498186bdcc80df8e8038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9502cc00-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "22c1dd17-b521-4725-b545-eba0b0a3263d", "comment": "Malware payload (Formbook)", "value": "3ec946c87a5bd89ad8b744a2dc9771a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "598999f7-9540-45b6-8b5a-79c911b0cb92", "comment": "Malware payload (Formbook)", "value": "1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "5aa28e5d-8950-4044-87d8-1c269f524710", "comment": "Malware payload (Formbook)", "value": "235f368abd1a8396a14ddd6bb7e491fcc91211b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "a4210146-7e99-488c-97e5-d0856225de8e", "comment": "Malware payload (Formbook)", "value": "1d9b33bf3ecbe8c10fbba45900b91028fb3c479185fb1e9585cf0233d1f685d225ea27754fc45b6bf9300d51c6a99ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "7a36c5d4-637a-4301-b55b-76df907c4565", "value": "T156251298DE09CA12D9925BF46861F33E52715CCEDA04C3A7C9FD9EDF3C19B096C24982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "24dc5bd4-01b8-43c4-8b55-48b98b7b300b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "c1413db9-e8b6-4e17-aa01-7eb3bf14c918", "value": "24576:wJhdQAIYd24wqb4rve+Txeua059NFZ/dQ1lfL:wJhdFlLwqbGe+TIun9h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370745, "uuid": "1074808e-f60e-487d-81d8-8f3ea8820172", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370745, "uuid": "02d4017d-0443-45e2-b150-c81b7148cf5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "628c2298-aab6-4d52-a54b-de480661cce6", "value": "1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c3621a-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786370685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "e82cb33f-1a45-4092-8ce2-37f20f2914dc", "comment": "Malware payload (GuLoader)", "value": "a16767a43943bc4c2e25d69ca4ca68b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "03deebe3-3d79-483e-9208-0d255d9e3f42", "comment": "Malware payload (GuLoader)", "value": "1f699db45e66e2a2d404231be31e51d3a6d390a73beaeac4401de6866397dc4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "ce7057cd-25a8-4937-b27d-de24d60f2888", "comment": "Malware payload (GuLoader)", "value": "bed104a086f69d9fd7b69f6b7f1797b18a26c862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "b9b7c727-236c-4ca4-bc54-4975fcae2f56", "comment": "Malware payload (GuLoader)", "value": "ac899c3042a99d852c586ee2e127163990e9ae2dcde47d8c8318825e6008f4ea71b8c8b425b7a57f7fe392c12a6d6873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "0d5556b5-514b-4da1-aca9-aded38904930", "value": "T1DB94CF83FA80D6AAFC3D4875D9A352700B72AEB596854F4353D879123FB22C0753B52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "444a05e3-c5ee-45f9-896e-48af4a9198df", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "38c3b600-09e5-43d2-8c3d-0c0dd8c01c6d", "value": "6144:omGIhCrl0WKxHId8CWoWZGipPIR3oRsu22KqEWriKUofF9a5q56zX:Pm0NxodvEYuu3o82KoriKUC8qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370685, "uuid": "f9d29bdd-81b4-4a60-abca-d46682edb238", "value": 412744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370685, "uuid": "1471baef-9cee-43c9-85d7-1adf11d5ef93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "3d12fe0f-bb8f-4320-b543-ebd0dd22ecd0", "value": "1f699db45e66e2a2d404231be31e51d3a6d390a73beaeac4401de6866397dc4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0750934-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786346364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "4ae80fba-84f2-4448-bde5-513111759ede", "comment": "Malware payload (Mirai)", "value": "e57f1fb416c86f6c1f90769d36df28fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "d688325c-cea4-44bc-9596-1b0979fa813f", "comment": "Malware payload (Mirai)", "value": "20152d401c779e8f47a6d9a5fb379a14d45965a2ebb9df3d8535a9ff48f02173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "89ce0809-3d9e-456a-bf49-153cd8cc26ff", "comment": "Malware payload (Mirai)", "value": "f72ec98c5648f6232e51c885368928d707027270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "347a9ac5-948b-41ff-b42f-db0d47443adf", "comment": "Malware payload (Mirai)", "value": "d1413a18e2db4715fbb4ed81b9f6cd993c8a3ffc413d35a436d21a401a69b0bef3749c035c83e151c233a9d199115c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346364, "uuid": "c71df76e-0264-485b-85df-ba6bab54b043", "value": "T100941A4463B0D7DED1AAEE70223A3F1A9FA60A2730977546211FFA2303B217149D9DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346364, "uuid": "20a532b0-4359-451e-a431-1a040d20f654", "value": "6144:/S1zDjpM5wpRIBvSeL/uYUrwU8aQlvuDk9mo26iQ:/S9jpM5fB6eLdU0USvu4l26iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346364, "uuid": "f49772e8-85d3-4ef3-9cad-7c2adf11641a", "value": 410384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346364, "uuid": "3c691e80-36ff-47bc-9183-2d5193f16c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346364, "uuid": "c393ccb1-d699-46fd-bda8-35b4fa805e08", "value": "skid.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb1611a-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "8733cf56-73f3-4fd6-a2f6-1370c6901139", "comment": "Malware payload (Mirai)", "value": "8966b031553ba7d8c6d22e804a2e6798", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "61b5fb8e-4af9-447a-9e53-88af078bfec3", "comment": "Malware payload (Mirai)", "value": "20a39dbab341d848280bb34b1bfbb40da0837b918ab3ee7b2dc77a9ac28b0c71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "cfea4423-13e2-417d-bb09-2aa95dcea865", "comment": "Malware payload (Mirai)", "value": "455ffbe9e2e79df9da55c7f7500dea96d516405f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "701f397a-e0d8-4c5b-8aaa-fecbb8c0184e", "comment": "Malware payload (Mirai)", "value": "11cd3305c24651da851c2049b0f93d577ef28b90476c292a61817c38fb05e54bcca69d21101d57c4e8d56878fcf19964", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "1101a345-84dc-49f7-87d5-f2e0f892be1c", "value": "T1EA042996F880DE62C6D027BABA9D42CC33131778D3D97106CD246F3977EB95A0B3A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "fceef6b1-325a-40eb-8d2c-78739d1fddcd", "value": "3072:eG1PvMN02dv99WVuuu5JNBWRRUeEvIZwOKD14WgWYinrYTtaJ:eiMN02EVuF5JNBW/KIZwOKD1q2MxaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383588, "uuid": "2cccb987-1287-4d9e-ba71-9c81bfec5257", "value": 177724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383588, "uuid": "bc987406-af29-4905-b1f2-6da38bae756a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "19505296-a4c1-4d0b-b549-39ca2d98133d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e0fb22-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "291c70e8-ecc5-4e32-9601-d1eb4bb61d9b", "comment": "Malware payload (Formbook)", "value": "12c19c2d6adc24c952532a015c826e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "c349274c-58d1-4b41-ba3c-da0e2c4ccba8", "comment": "Malware payload (Formbook)", "value": "20eb8e89be1911a5df6d76d8b0974f06af67fb1dc0ce28bc2912955b5b2ba734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "c4b372af-b02b-4827-8e02-628e16690382", "comment": "Malware payload (Formbook)", "value": "a58819c11c7878de44652930107ab1480ef0fec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "6dc96abb-3705-4c84-afa3-cbb8b421aee4", "comment": "Malware payload (Formbook)", "value": "bc8bbe890829bd96def972244a9085716fa6fe83891be0cdbf69809875095e6bdc51e40550414a6ff135b2cc6827aa24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "ece84d41-dfc5-4d86-a69b-246f32c5363a", "value": "T1E83502992355CD03CA931FB15DB0E37841B95D99B421E363CEFABDEBB87A3852D01281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "871e4d4a-78bc-4891-a9d9-c6bc48397a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "50793054-41b6-41be-845c-e4aa4ba4dd8a", "value": "24576:61jR6pFsRxs3PeoLvUVEcvoNP/InrEKkeNXQTfkYZHXqf:ktimRxAeoLsXvyInrEK1GfHJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370957, "uuid": "86773581-2c42-4090-932f-9df4a92b9727", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370957, "uuid": "4ce4e176-cf5a-4495-9c16-4675c54f4bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "6607fdd8-d1db-44e2-8bcb-08b2ac8a2a82", "value": "20eb8e89be1911a5df6d76d8b0974f06af67fb1dc0ce28bc2912955b5b2ba734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1122b321-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "93f7c823-0a28-4119-b7f5-85ed74d0b664", "comment": "Malware payload (Vidar)", "value": "7ac5973cdad3cda8d00be62402b2b5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "113cad67-3173-4ad5-b7b3-1f6a3defb154", "comment": "Malware payload (Vidar)", "value": "210fa1c6af0add59d77e4ce91e68f22fc257c8ff2d0c175ebb9534267445ef81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "97e806d3-4a81-46a0-940c-c9b0f8063a5c", "comment": "Malware payload (Vidar)", "value": "b0b0af6453769a85682a776535475a5a0cebb5a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "79b2330c-d4cb-432f-ad3f-bb894e7a1391", "comment": "Malware payload (Vidar)", "value": "4cb55e7d95e22e9926b6843d8bfaa456fe7dbb6434f36372a9beae046502748d4414e5486625964b38433eafa9b26118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "86409fe0-9717-42b8-83a2-8a16c6dcdc86", "value": "T1CC52D7C6F18321F8C0A9C339C75A1267E5B970821A3A2B3F5BD854A53F8163475AD7E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "a108e79b-97be-435e-adab-e4c883cd0068", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "97282d10-ec57-49e2-b4c6-44a49247ff4c", "value": "384:OAb4OZD+mz4zTEeu6dwCDYFkWXC4ErmIhwl:z8Ot7zuEViYSt4a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369236, "uuid": "bda2113a-6c6d-4442-a06c-d805ee8b07c5", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369236, "uuid": "e45b11e0-0773-422c-9394-0aced14b4cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "5709352d-3b94-49d7-931e-90538693f696", "value": "210fa1c6af0add59d77e4ce91e68f22fc257c8ff2d0c175ebb9534267445ef81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9204463-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "c531fb45-1e49-48f3-8a20-30cf3b1ea06a", "comment": "Malware payload (AgentTesla)", "value": "5e4a8d6b941d10d7f7687fda9ac3e6de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "fc5e2fa7-8ef2-48a8-9135-8cbde964a32f", "comment": "Malware payload (AgentTesla)", "value": "218c261e5117a1448c12d6ba65c935480d34debbf1fc9ae0041fd237c5a3a1ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "ee533aa4-5cf2-4a21-bbb4-c9f1ea1cd802", "comment": "Malware payload (AgentTesla)", "value": "021f7cec5d2d945e60b22ca5d36e1d9d854028c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "7b65f6f9-22f4-48a0-9961-a68324fa4654", "comment": "Malware payload (AgentTesla)", "value": "857f578c0bb98c0ff81a3e0c3a27b08848c4e5e94c4cbe62c8772936dadb197a40e0a3dfa3acc328837c6baa3d6aead2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "c77e19b8-5eef-4f89-b410-593262d539ae", "value": "T1362501255316DA42D0D687F6B9B0D3B532641ECFB6E2C2D29FE92FF778193C11960282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "bfbe5e08-3486-49db-9cd4-acbbd8d708d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "5ec5bf88-ab4c-4a7e-a4c0-65f17c458c1f", "value": "24576:6/IYp50k9aAVmfgdT3L2r8q9JhC9fOS0S/8p/ZBS86FVE:6zpclIB3SgKafbb0p/Zk9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373410, "uuid": "9b529074-e2cb-4a3e-94a7-defd6d00bd8f", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373410, "uuid": "efb5d17c-1397-4fd4-95d1-a4ccc45e9a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "f05e7d9d-5493-4e92-97d4-dcf99821021c", "value": "218c261e5117a1448c12d6ba65c935480d34debbf1fc9ae0041fd237c5a3a1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ef9837-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "c56dd5b7-539e-4883-a384-c8ac4097a36f", "comment": "Malware payload", "value": "975fe30b7d5f61f3611a6821424cd97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "bcc6f11d-daf0-4b8a-aa7b-8874ef0f9442", "comment": "Malware payload", "value": "218e134a8c4d50d8da163690bbbbbfe4d5af0163b0eac9d257d3cc5b2555941a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "01455446-954d-414d-8782-7f771f4daf41", "comment": "Malware payload", "value": "9a595787e70d59921640f1e5e5843ca3e9322e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "8fb19725-9af5-4fd5-b694-13797eed323f", "comment": "Malware payload", "value": "9de7aaaf0a0b7e15968a752ab5f1ebb356e746ff349beeae687e41f9a41b37b77330b7be4567361ba7ca9273d1e78553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "3a7eda6e-5800-460b-9ab8-11507ea33bcd", "value": "T19A25F1256EC72F91D63D4B78C162098833F0C6179256EB9F3FED10F19EA2B99CD16092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "7a3bec12-51b3-432b-a579-68e6d167b8fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "fdbbfa19-8568-40dd-b7bf-f95a8c46ac74", "value": "12288:7kVMZebB5kODVKaZuCgHebdfSDl4NHo2agGIEw2GClNsf:defksxDZsR6HzLjEw2GClG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368997, "uuid": "e53d547a-9309-4a99-8575-ff3704019b61", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368997, "uuid": "9ea9c89c-748a-4c32-a1ef-400e5c37d0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "cb0314ea-a610-4cdd-a076-2356d2e63186", "value": "218e134a8c4d50d8da163690bbbbbfe4d5af0163b0eac9d257d3cc5b2555941a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0bcc03-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "0e849fa2-87d6-4e0b-8c1e-c06a55882e7a", "comment": "Malware payload (AgentTesla)", "value": "e083c63317a312fed6f7e21760adb97f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "83fe134a-ba68-4a55-bd14-b8385c0ad2e2", "comment": "Malware payload (AgentTesla)", "value": "21f2400b51b84f63f7e610d3ec5890cd5a046bfe63580760b3537a99a557d6dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "c4e0e940-9f3e-4f6c-8000-63ca870ebf01", "comment": "Malware payload (AgentTesla)", "value": "af593de5b9f7061387d0cf2291687da283dc3470", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "bb0d95b2-6cfa-4f00-ac21-9c8835c187b7", "comment": "Malware payload (AgentTesla)", "value": "bcdbd0dbc353bfe04ab1c4b4ba5cdcb96db5e8a8359c295ee1b431f82a9f2797b9af72cb97e7a15f6ab4b0d5fd807802", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "c0e3124e-f348-44c2-a763-0e4c7a24da0f", "value": "T138459E6132DE8783F3FE8EB52BDD747096F0796CD6E9C21D3088669881A6751009D3FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "077e0e36-7ade-4e5c-b380-4575ddbcd49a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "f8fb483c-e8da-42ba-8030-2035312865b3", "value": "24576:5U50jhwH7krKwIPOr+e4ggVqRXOIJZctv:5uewHsFyggMXOI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370732, "uuid": "28e1fb98-9a27-40e7-8267-8fb757d7ccce", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370732, "uuid": "fa977284-494b-4825-80a3-46268a04687d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "0a0c7d7a-18bd-4f1e-86a2-a82f823219f1", "value": "21f2400b51b84f63f7e610d3ec5890cd5a046bfe63580760b3537a99a557d6dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3add5d1-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "b4e02658-8f8b-420b-b50b-a8352b6da463", "comment": "Malware payload (Vidar)", "value": "8db43cde3a816a8fbe05b41eb790c07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "f5ad3c0a-8bef-41a8-aa8f-2c848a0c24fe", "comment": "Malware payload (Vidar)", "value": "2209c288643a3b6df2f55605896268f1dbc2dd0587b450023d30284afef196b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "bbc5b99b-b21f-4dcc-a729-0f1f512e672e", "comment": "Malware payload (Vidar)", "value": "5e6df309ee7328a129b072b0d4c35a39511905c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "40789d3b-08dd-4024-a498-23c0da9d3d07", "comment": "Malware payload (Vidar)", "value": "77a67ceb8dbe99d56906d7c489565ea6c451e1a6dec6dd69d60290a617a152836d08272195090e24ac64a576b8a0f71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "b780dea4-3adc-4648-b439-035b5eda1660", "value": "T17E923185E1179AE4C4E1C333A76942A725FCB82032355A7F9BDC6A3B4D41370EB642ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "c7ca9d9c-b30f-4ad3-9278-ef9c31b8e99f", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "4dbfdc0a-44a5-4d50-be21-90df52d11136", "value": "384:OOL1XRYPFonFJtjur1H28q6fz0gzElvJhvdkqzlj:9L1XRYdZ1lPf+lx04j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371226, "uuid": "ad70b429-2cd8-4bd6-abb9-64b4a4cfbcae", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371226, "uuid": "7180bee4-cd8a-45b3-bc81-aef518d55d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "13b210cb-5781-4262-abb1-db2b53416da3", "value": "2209c288643a3b6df2f55605896268f1dbc2dd0587b450023d30284afef196b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b843b2f-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "6b69526f-f886-4247-af1d-28dfdd61801e", "comment": "Malware payload (Formbook)", "value": "ca014779987e06e1e569a5d86e36230f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "c0d7ab13-be01-42a8-9b3b-e692b0679f38", "comment": "Malware payload (Formbook)", "value": "22243e2049e0a3d60c556dd7740f096084235ef4590c7d500e89b8bf8ee8dd0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "7395f0ca-2f83-4066-871c-866daf82ce54", "comment": "Malware payload (Formbook)", "value": "fb334de84fc4f0c7adddf63cb62eb310345a6bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "aa13a431-1e20-4542-9a5b-5be8a98b823f", "comment": "Malware payload (Formbook)", "value": "a2a87112c4648f505877ca74a8da031db7595bc80349092be00e163dd7c4b64306dfa403d56cd01c8674dbea33a87a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "977defa6-c0cd-48c3-a3d0-4a4cd6f9e2fa", "value": "T19F3502C43B2AA715DEA40530D679EDB452E92DB8B010FAE369DDBF4B79AC2109D0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "0f34116d-84fa-4ded-bbac-d1c76e5ef800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "3cb4cc4a-d19c-4c81-906e-7613fa96af0c", "value": "12288:nm1b/PNehQrI91U/F7woMMzQJ0eW22gCf+/EavLjJPU/kkJXlKoCwSHvq1qr1:m1BuU9MJDCG/ESjekWXsoCwSHvq1C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368394, "uuid": "d66691e0-2370-4e9c-bc2b-3e952ebc1c01", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368394, "uuid": "d31c1136-3f73-4a8a-9aad-cf80632103c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "79bc0dfc-bad2-40e8-a5b7-4c73691d96b5", "value": "22243e2049e0a3d60c556dd7740f096084235ef4590c7d500e89b8bf8ee8dd0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a457f3-94f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786392589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "89899e1b-6149-41cb-ab7d-f0f1cfa5a240", "comment": "Malware payload (Mirai)", "value": "750143543e57811c043cf7017460fb50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "f0dd8d32-365a-434c-8ca2-1a9b356fb5d9", "comment": "Malware payload (Mirai)", "value": "225ab724cb87e73be3995491d30b0d94c8da9c05c821deca78e5835ab470e574", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "73cc5ce3-7734-48d9-9be9-c47812982868", "comment": "Malware payload (Mirai)", "value": "18f470a555f4a60b051563dc8e19b6d28df57d94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "61582abd-98bb-4e14-9103-e9ee3b4b66e2", "comment": "Malware payload (Mirai)", "value": "6efd0803efa02db982bd81374a19b4127697080f3d282918fe34948c420cdc94b00b6701cee035fe357cf16d73942635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392589, "uuid": "d6986cd1-4163-41c6-bccc-9a930d6fe8f4", "value": "T12DC30A52BD429F13C6C321F6FBAE46583B126B7CD7EA3102E924BF50234B8DE0E26551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392589, "uuid": "9692cc06-d231-4079-aa89-3c5fc130e6a4", "value": "3072:khv7ugRMxmXlL6uVqDzIewgIVT78kjxx9EO:khvHlL6mBewgwH8kxx9EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392589, "uuid": "e01453e7-1365-428b-b7c2-5c91003b98a9", "value": 125568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392589, "uuid": "3630e983-d1a1-490f-8ce8-b822e649006d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392589, "uuid": "c5216992-b141-47cd-bf7c-fc0b1f8fed27", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c7c5d3-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786328019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "c2e88934-395c-4d58-9670-ccab83b87b30", "comment": "Malware payload", "value": "e618014ef07e84bb9f1528837eae666e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "a8c91501-32ca-4dab-83de-1fac8014cbf7", "comment": "Malware payload", "value": "22804a77a4bfbc5f5df66ee61f8cdd422b0ea2a589fdfc6667b3ea58fc2c0ab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "23866e44-3648-4d17-8454-52d1a809c36a", "comment": "Malware payload", "value": "74fc15de4c8e4d852b989f9d6f328ed8a70751e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "c34e71f6-5acb-4167-9b11-cac7d5ab3e09", "comment": "Malware payload", "value": "2522df6a34b3fa527065f16c77249b00cffd809116b077f22ba4b11d308b105375adc24e92ea3c16c9c3342b6952647f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328019, "uuid": "e430bf46-59c3-4a2a-9da5-8bff1d4a53ce", "value": "T10253D71BB6A3B0BCC247C0B45A9AD5B1B9317CB002213D7FA7C8FA312935E416659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328019, "uuid": "ff39d9fe-ccd5-4880-974e-955564a60d06", "value": "1536:FSW6tN+bRAIxS2J7D0yWwwXuvZCi4IVRuGW2EUr:FtbRA8RJ7Dsat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328019, "uuid": "038387c6-bf61-49fe-8184-0481c8490b03", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328019, "uuid": "2a50f40c-4d48-4977-9aa1-c90730f3474a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328019, "uuid": "e5227c97-6101-45de-8ede-846776f868bb", "value": "main.x86-64-i7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2919290c-94a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786357250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "13099f80-7bf8-46d2-8095-0d29da8a1f56", "comment": "Malware payload", "value": "08dbcb220edbfa9f576057e64861600a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "e23c7968-f5b6-4235-abdd-ffce37dc2497", "comment": "Malware payload", "value": "22d379e19805ca9121f19f3148a3c99aa23fbaa2b686f0bbf24f9ef45c32388e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "238b7ec3-41ab-494d-946a-7286d8b73dbf", "comment": "Malware payload", "value": "943d7d1bb4608bc0bde5862b4de683aec821f1e1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "ea2e410e-3bce-460c-9969-b8b21868c8d4", "comment": "Malware payload", "value": "a2748a5e4f766daeb1005de985846c3eb04fa84f40032f4f6a721dc6559dfe5e2f2f747b466ba1401166601c95cbcbd8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357250, "uuid": "44961ebe-20ea-4845-899d-603e4cb37180", "value": "T1CD32F6CCAF9063B4F29703CD37AF2999132661CB904CD984F64C6DF06F4B68D4A46E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357250, "uuid": "5d7782a2-9d04-4ac0-9c23-069ce596c2da", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzjlX42AiYOpzfMclFl9CX:sXX+/DV7k/3jlLAiYOpzEa9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357250, "uuid": "6d20ce31-5e72-4209-a753-d3c20fb22d61", "value": 11994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357250, "uuid": "4907a45e-572c-428d-a8d5-661dbfc08fa3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357250, "uuid": "7ea9ca7c-2e3f-4c1a-a4aa-873cb2804931", "value": "rooming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9248d312-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "5b94121a-68cf-45a1-86f3-50cb95d65c9e", "comment": "Malware payload (Vidar)", "value": "cbf643d4160bbd34578dcfb3b34d686e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "3f0dbe81-8e6a-4b3d-897f-f13242c4a872", "comment": "Malware payload (Vidar)", "value": "22fb3b615773edfb1af40e88114d066b15dc089616c7a865dc4788fd37371ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "25f39503-4588-4ebd-9f6b-f82c47a64549", "comment": "Malware payload (Vidar)", "value": "097b5c5db936eb41e089d7aeda657cd90a8bd410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "bdaa3d43-e545-4418-b839-2fc8d70747ff", "comment": "Malware payload (Vidar)", "value": "2c5e8647f8f3cc489d6d7da10660ac13ceac8713a861246ee272d2df96f0dcbe22946e2ca924321ca7a33b10d4d3013a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "117d7b19-751d-4b67-9838-1cb9d6e65735", "value": "T1405208CBB1A351BCD0B9C37DD64A01EAE772308207265FFF07EC87142BC6A1036A8A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "f13ba81a-93b4-41df-a166-a666cbf29e23", "value": "e94e649e836c8320627dfabdbb134df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "ef2f65e0-55d6-450b-aaf5-aa4fdfb73b3a", "value": "384:OjuV/b9KRPIIFbnR9mSfZbqkrbl2NDKYT1TCsCg:eBbnbmub32NDKYT1TCsCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371170, "uuid": "e453178f-001c-4a7d-a857-278542004eff", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371170, "uuid": "484c8a25-4f7d-40c0-ab1c-7668362fc9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "3636ea17-e918-4ee4-9cc2-9ad54e2b96f4", "value": "22fb3b615773edfb1af40e88114d066b15dc089616c7a865dc4788fd37371ce1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b5157f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "9427b02c-ab44-4280-af4d-81193ad47703", "comment": "Malware payload (Formbook)", "value": "8d092404d0a2022ec19b7a4c32692d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "ca2164b6-8559-4218-b0b4-858b29850216", "comment": "Malware payload (Formbook)", "value": "232133d7659d0b8491114ebc60bdc27c02b7adf41299ca33fb6ea53445b397e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "d0dd15b3-f41c-466b-9676-70c6074b140b", "comment": "Malware payload (Formbook)", "value": "8840e74883ce76a33feed4536b5d9210d7cc3097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "ba2bcd3a-ef32-4837-9803-8da54154f1a9", "comment": "Malware payload (Formbook)", "value": "e48653cf45b33bf0896c0f87394ca8ab6661a53bd11ba459d890d88b5a3f0d07f29c2dad40b0b241683b0d323c9bc20b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "1128fc02-2524-4e5d-8060-f9b2f71bc4b3", "value": "T15E2512402699C501D6B997F88A72F2F103B13C6EE901D6678FE8BCDFB8327416914B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "ebb9487b-93c2-4851-83d5-824a7d9e5ff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "726b8f40-c3c5-458e-9856-b1fccbcd9e03", "value": "24576:65Q4uq/QeByrbyWHPV+o0BffJA1rG75iYmEM1nChzv2cWthX:UQ49pIbPVK3JirGo7n+fmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368832, "uuid": "75820a9b-e0d5-48fb-9de7-73b6696d4f5a", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368832, "uuid": "e8cff485-4e4b-4d18-91ee-c34e38db2662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "f02fd35d-4db6-49d2-a5ec-87e733ff21fb", "value": "232133d7659d0b8491114ebc60bdc27c02b7adf41299ca33fb6ea53445b397e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837bf84a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "c6de23ff-77fa-44c2-8d2e-b035cb365ea8", "comment": "Malware payload (Vidar)", "value": "07836a414348a3d5684e3f393c8acb16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "5966b6b0-a151-49c2-9bd3-a5bd6b2471e5", "comment": "Malware payload (Vidar)", "value": "23291fa45184b121f7a59346b4e97083cb17444b311e43600bc230aa7a4406e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "09058ae6-0e51-471a-99e6-8374a24a0a1e", "comment": "Malware payload (Vidar)", "value": "4d5b15ab26b2715bd67f172604c4a28b0671315c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "0635eb29-b7de-4a7b-a9eb-3c9a94699495", "comment": "Malware payload (Vidar)", "value": "9e90ef935f7a0d3000cb79e51b47f86dd7e7c9632659d6090828bbd1213c92ff079117a84a1f2adc991d41b9a39c178a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "a1286108-62a2-400c-8715-613dbc5161f3", "value": "T1E7827F45E20B52B5C4EBC3379766561316F8BC013135673BABECAA721D42730F6282EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "614540e8-9f74-4d2e-964b-0327386ab49a", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "096f968b-cfaf-40dd-b8b2-16be78341e7b", "value": "384:OamvmYXwZf8sUCLnwbNVW/4vqQvxOC6bcRiauKlx:GmIC4NVWgfvr6bcRiXEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371146, "uuid": "850bf523-fdd0-478d-8fc7-bd0ef596551d", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371146, "uuid": "59ab4a7e-c2d9-45ce-91bb-bcd1ddba810a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "f2393f8c-8b03-43cf-8c89-93161a789adc", "value": "23291fa45184b121f7a59346b4e97083cb17444b311e43600bc230aa7a4406e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa71c07-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "7e61174c-65e7-4421-90db-6f5113f374e5", "comment": "Malware payload (Formbook)", "value": "e21fe731e011bcf0a181f2c894da220b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "97d593d6-8135-48f0-8065-e052923e4a63", "comment": "Malware payload (Formbook)", "value": "23a8568003768b2f4e2fc3bd47a6d6d054c11ce622737d27df4c4f1bb0c28146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "84785aec-b62a-46b7-b5e6-2650013da6cd", "comment": "Malware payload (Formbook)", "value": "11af95f07370e84620ebb8d0feca1920035bf3f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "74c1e53f-a514-41b4-9635-7701a0232063", "comment": "Malware payload (Formbook)", "value": "65e5172b56688ad02214c8bec3dfecba8c9c52858995e2298df40bc038fed2851d6e28b7517be61a03417a42b4eaf21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373225, "uuid": "91298125-0ab5-4b69-8e9c-ce83f05a1473", "value": "T14F542306EBD391F6CDA08031D6CE15A609BF5C75E3D5F80B3B81A6CC8B752BA1E99350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373225, "uuid": "8ff7afe1-5976-4c20-a00a-090c7119b43e", "value": "6144:rZ1jy/W6CdFAe6+RL7BD2x+K2rvF4OkJnp3D2sVAATmoAAx/XQLc:zjy/WMe6+RlvVkZQEAUmoZ/XQLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373225, "uuid": "f4e81a50-34d8-45a8-b53f-a040f5a47c4e", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373225, "uuid": "19b0e894-3f6a-4ff5-89cd-563da7256f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373225, "uuid": "c8858c0b-3e63-42c9-8711-547bbc74bcc5", "value": "23a8568003768b2f4e2fc3bd47a6d6d054c11ce622737d27df4c4f1bb0c28146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a118f7-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "166b6c53-bd3d-4873-8c01-89ef0237640d", "comment": "Malware payload", "value": "3676ba305ed080b8b895b2aae5b4b212", "object_relation": "md5", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "07d0b446-84f5-49dc-b33d-0583146ce87b", "comment": "Malware payload", "value": "2447a57cee38107f77c46a531095b4fffc5f2af604e945396172b4f3edb9188d", "object_relation": "sha256", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "8ab6534e-b2f3-44f2-b545-93baa1a062e1", "comment": "Malware payload", "value": "c9920a6b209bee0521a84be33691461acae64fed", "object_relation": "sha1", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "94584d2f-0614-406b-9589-068206d8692b", "comment": "Malware payload", "value": "e1a1813fc2f2731f70c6f40ad5e5dd1073378f6555871fdf3a417b796e31fd74987369174197567f4befb2bf8fdf3148", "object_relation": "sha3-384", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394617, "uuid": "341a0972-933c-4592-8684-4cc0d24ec78b", "value": "T13C9285B1B70ED99F1763076A9AF135688D2FC1BD25540BD0F49FA02AD7F8948058D2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394617, "uuid": "18ae00bf-e130-4356-a434-7ff962be4c28", "value": "192:+hXgNoNSAk7tNn3W/4mQJfv55531w+JRmp9J+AUJQRLniwjD4iXt9i9kYrgEH9h:65uRmpb9hRLnrfd0kHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394617, "uuid": "ecd0e147-74dd-407f-8ee8-8ad2d8d90865", "value": 21076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394617, "uuid": "30389c14-f760-458d-8c87-9b84e8551c8f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394617, "uuid": "5a2fc4e3-1651-464c-ac43-df9ccd70d751", "value": "iis.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea8e4f1-94d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786375674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "ce28e6b9-db1f-4775-ab3c-5a510ec24662", "comment": "Malware payload", "value": "f96d658f3a06730e88c6b1e39ff4b054", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "095c57d3-eca4-4b7a-a9ca-d7dbc5e62374", "comment": "Malware payload", "value": "244998b9eb1d4c64ae37c76010651b0e63307ac8a9ac454884aed7b3d3582227", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "c8259d3e-c741-4df0-81fb-38c9adfc8343", "comment": "Malware payload", "value": "168ae703ebee17886422449c91d93c3d9e876235", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "041d04c8-10f0-45a5-bcff-462d039e3365", "comment": "Malware payload", "value": "b335f1e523bd001fd865b67b6a76f95843255b2b22574095cefc41736e51e69f9e7e83128e0667ae1253db9f19bcc265", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375674, "uuid": "55c7738f-e4f2-43a1-b466-1a135d3d228e", "value": "T18FF08C03A48BF036808439A8EB76F75AFC24BC476262CE4CB840BA50DED64247861240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375674, "uuid": "958692e2-8215-4d59-92c6-54dd6cbc5185", "value": "12:lSjhh1OL9ephRjk4Y4bou7Co1VOq2xddNizdI/HXu81lt:lk1gYpTr8i3fOq2bf8IGMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786375674, "uuid": "82bd85f2-d721-45aa-9db0-b0b56a413145", "value": 495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786375674, "uuid": "6d1c15f6-0455-4539-9c64-76b3db2cbc01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375674, "uuid": "d834b64a-9694-4250-bacc-00b924661bbc", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b15f00-94e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786384348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "453fb317-f061-4903-88ca-77a5d2a3d01f", "comment": "Malware payload (Efimer)", "value": "7ba1aadad4a85a60ed8d531779a12422", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "5c3ca249-68e2-4a3d-8965-4225d5cb6ef9", "comment": "Malware payload (Efimer)", "value": "246d4bf560910e8db5f1a2b5c28bf6252fc3eb6fc6797f8d9a7b5beb8eade556", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "24f4451c-d5d9-4f13-878f-83a31975cac1", "comment": "Malware payload (Efimer)", "value": "d3ba419e0cd5c3344ab12f6a126292260f570179", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "2a4003fb-2ffc-4a91-bcbb-9edf31e64c26", "comment": "Malware payload (Efimer)", "value": "3ef793467fea729ebead0f6a98751b488106147c8a7d95b20f7c475285da4ce4ab83eeb15eba5e89317034f755f2c92f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "ddb645d8-6c4f-4136-82a1-72bddebc1fe6", "value": "T1ADE6334D7BD012FAE9E38038DFE002B5E22978B54772C5CB979457916D932E08E3E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "7967efd9-3a34-4550-8d17-5e6703cf3e1e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "a0325c42-3d41-49e7-ad30-17ee6fbeffb8", "value": "196608:W8EGqSFP2SYdfDK8NZKJBVIAtqUv8tXMCHGLLc54i1wN+MKPIcu9KYK39sI3PPG0:W8Esh2Sm4jL6XMCHWUjccuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384348, "uuid": "4e1bfa9f-6e15-4845-bd89-ac04c10a932c", "value": 14078229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384348, "uuid": "03e9e035-e86e-4c52-a3e2-a1b03859787c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "6d75f7f0-7b9c-4027-819f-36d0c9b4d4a2", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcab00a-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786372482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "49089b19-04de-471b-9878-c5b52a4c824a", "comment": "Malware payload (AsyncRAT)", "value": "923fd65806ce746ef544cad3d1568a7a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "0ce6e9cb-f06d-40f9-b8ba-f096aefecd18", "comment": "Malware payload (AsyncRAT)", "value": "248d6fd4d064a4ced3a75ee493a43afb2a909d3c14726150685fb26147fc8d3b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "086520b8-0dc0-4084-a9e7-0595421a0e82", "comment": "Malware payload (AsyncRAT)", "value": "ac75741b8422118cfcb330315b317341ab8c5033", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "ff786567-ae33-49f1-bca7-0824ce08e74e", "comment": "Malware payload (AsyncRAT)", "value": "7adad4f5f27c4478c65343fd9b87907207a56500e541a12cad196b9d1187a636bcc5f677b7caa8478e8091a6130a583d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "14be17b5-46ac-47ae-abb5-ee06b754c88e", "value": "T1A335E15462F5EA4CD2518BF308F0D1305BF1AC19A92CE24AB9F5BFEF7A7624121493B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "208cd34b-99e7-4e92-b1d5-8cbf7a394b41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "51c521a0-ff03-4ef5-8fc0-60a8b5bbbcfb", "value": "24576:NO+Lqj/Og3rVZzdcH0CBszfFJs6p7kWZlG:NO+LIPNcH0gszfV7TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372482, "uuid": "5b38ee5b-4afe-42ef-b5f2-ac3dd13db361", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372482, "uuid": "adcab5c3-6044-4862-95ff-2e0abdc4815a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "5da1d48c-deff-4522-8b8e-237c41f54683", "value": "248d6fd4d064a4ced3a75ee493a43afb2a909d3c14726150685fb26147fc8d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c944c0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "c70f8a62-531f-49cc-b76d-d83f967a5d55", "comment": "Malware payload (Vidar)", "value": "e9f9365fc978fc8ce169cf7a95e77ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "c6c1d618-ea33-4ef8-a25f-6be27c6087df", "comment": "Malware payload (Vidar)", "value": "249b0b9d87c8328e1b66f69c2308fdb1ea793c3e50d3d7522291c779789fe104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "85f5e98b-a1e7-414e-a764-68e0070613d1", "comment": "Malware payload (Vidar)", "value": "78054a9c010a6d55ddaa0a169b338f914841b356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "ce60b468-1dfc-4095-a479-fd8ed30826e5", "comment": "Malware payload (Vidar)", "value": "d6fa4c07b66267e4db5528f2b60ad51fe933bf5b536ba20a13e2617870e0ac05b798d5f80b4d98115dd1bc6781750847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "81c8dc3d-1a39-4361-a626-c82391ed2dff", "value": "T19042F783B2C4C1FDC1CAD37899AF14BB9A31398407A696FF7290C8945BC7656B63C981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "d48de931-f51e-414e-9c27-0b49d438bb24", "value": "4771e6f45e35660c0a3e9d4423dc0d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "0ff2c487-5554-4308-b01e-1b8dd889ad93", "value": "192:O4IP531CqztN08OqcGlzzxcRC24aBq6ZYV/ublUl/o3VOfD:OHN0fqL24L62Nub+olOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371903, "uuid": "1b499abd-6434-442f-9a4a-10d0929e2c61", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371903, "uuid": "6612be0b-3a15-4ee0-a1f5-3d6e71d1f8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "d6adaca2-8807-411e-8c1a-adc0829741ab", "value": "249b0b9d87c8328e1b66f69c2308fdb1ea793c3e50d3d7522291c779789fe104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e66297-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786357035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "e37867bb-a75a-4bdc-9cf7-0a1c40a2ee37", "comment": "Malware payload (ConnectWise)", "value": "ae9893c7a60b298f3f45b85726e09a98", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "e73ce713-0cb3-47a2-9878-c0bf26f59c6e", "comment": "Malware payload (ConnectWise)", "value": "24d5d3e5095d9bd866d657c646d5c4035e64315c7ba3c17b230415f0bef8c0d3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "df41ab74-18e1-4a10-9a51-8f93c51ef2cd", "comment": "Malware payload (ConnectWise)", "value": "eb63f8a9af89d85b71ca649ed826c4244aa81e39", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "d92c049e-822e-48b2-b675-d2b683d0e235", "comment": "Malware payload (ConnectWise)", "value": "f5e12ec208ca77bddd675efddbd852ac80a69348cec633df475644eb6311857ae71ff36030b9fb951a08d5821058b31b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "5987e0da-9b7d-4874-90b8-2fd099183809", "value": "T1D446E101B3D695B6D1BF0638D87A56696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "d0e57bdc-4f7c-4d77-a29e-9b07ee9af8c8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "4972b54b-2c5c-4a53-b942-9127ce9f45a6", "value": "98304:OzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlpO:OhfefPtHxcp9ym3nltDUJVbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357035, "uuid": "82d59a7e-7766-4295-b6bc-3d541d4733de", "value": 5789624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357035, "uuid": "0d38faf9-458a-4906-b5b6-d7c8fb521eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "cbe48c04-b662-4060-b97f-1dc1def3146b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbd5248-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "36c2e97d-7dcb-408b-90bb-6769f1d42c6e", "comment": "Malware payload (Vidar)", "value": "f26b02228093fb9ea2970b1acfb4757f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "04d5b61a-ce35-4ecb-ac2d-b52ecf15467b", "comment": "Malware payload (Vidar)", "value": "254b3dbd0414cb9b5dcd6ce3e815615fb3db9ed76642824ce644609730173037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "995a5e75-86fd-417f-b2e6-16d0c8ec4205", "comment": "Malware payload (Vidar)", "value": "432c12c0b4baf795e99d9e52c3c8d1978c1f84cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "de4c81ca-8ef0-4391-8340-e36bddebe36b", "comment": "Malware payload (Vidar)", "value": "fbc25f62b33353a4d5615d6949d98f4ff57112fdbe9143b964bd86c0552a8e3bebc3762dda682eb70ed72abf1df40339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "130ceb1a-44a7-4a40-a18a-697c9ddec277", "value": "T111520BC6B18324ECD178C33C8E5F06736B6630A613195FBFD9EC09A016826513A7CB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "1e7afa13-6e85-4c93-bdb9-1e0700cc4026", "value": "351526ecdd2e2b685a290935bb32a240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "44795e2e-8169-423f-91df-3c2ce8b6974e", "value": "192:OTT3DPMfnlrxdTwgtXQ7lKJBJ+kXOWl7ODETiV+K0fwzD3V9FX4/d:OfzKlbTvtylKnokXX7ODycUwDl9FXcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370384, "uuid": "d272820c-4928-4a10-a997-e30aedeb755a", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370384, "uuid": "0516e80a-4686-4342-9ad3-55059d216be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "f1d3926b-70dd-4547-b9af-8602b8df50d7", "value": "254b3dbd0414cb9b5dcd6ce3e815615fb3db9ed76642824ce644609730173037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942ec074-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786372462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "92cde8b8-9264-4305-860b-f29d0f8c0c41", "comment": "Malware payload (DarkTortilla)", "value": "78fd5a813173323ab23bf02192496c9e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "59874e23-5335-4dfb-b15c-e74d9d07acf6", "comment": "Malware payload (DarkTortilla)", "value": "256ef225565388227fd67c6e4a8c6e1990df8f660fb4504813c31bd57d9269cb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "def92bf0-4fbd-42e5-9ca6-8bb3a10028a5", "comment": "Malware payload (DarkTortilla)", "value": "63ee17dacdf50aaa4f49c6fc86c82f6afa73faca", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "50b06183-827c-4a67-9577-23a99265d8c6", "comment": "Malware payload (DarkTortilla)", "value": "3208f824d88aaa15e22c951935272ea00914e51b90592911536086e4795da571f08662c983b4d9bdad28873bf1e09772", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "7b76455b-7f3e-4d9c-9a7e-3247b604ff18", "value": "T17445F11A13D4AA68E4FEA73157B4001147F2F80B9736D71E6D4C50EE5F32B829A66B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "1f6a63d5-a8f6-4189-8428-f5ceb2258e4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "dd20e954-2483-4fa5-9662-c301be1fae44", "value": "12288:pUq7p14OFyLHK9Jwe4ezKWusA8Z2vjtxIcYzLzCZeGRpQ6s7EwKz4RH6uG/dD:3UOF8HKLZ4e2sAh8cYHliKkzyv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372462, "uuid": "62878108-eeae-428a-a327-f6b92bca14db", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372462, "uuid": "d61e860a-c50f-423f-9ba0-be575aafe0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "9eaf3aa7-7f39-4a6a-8e1e-b39a56fb7e0c", "value": "256ef225565388227fd67c6e4a8c6e1990df8f660fb4504813c31bd57d9269cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f49376c-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "baffd004-3f64-4fb4-8c8b-71ab8287f134", "comment": "Malware payload (Formbook)", "value": "c3452fa146426e3210a7f56276df2f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "371f6b6a-3b52-4055-a772-1c97728be388", "comment": "Malware payload (Formbook)", "value": "2598b0f8297dc652e3fe52b3912895d9f81f6435ba0f7ffa00d71c491fc914a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "54261081-7f28-4306-936e-619dbb46a2bf", "comment": "Malware payload (Formbook)", "value": "6feda9804670ebf1c5425c605701e3826a44a6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "13147aca-ab41-4b09-b615-ffeadfb2d44a", "comment": "Malware payload (Formbook)", "value": "662b38fd946cf64566d805f56e4a368e9eae86e2ec6b7441f3b653999c7bb7f6130b83014d30d17d5dca7efa9201b84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "62852ec7-1440-49fa-93d7-0ddc8fda73e0", "value": "T1BC2523294B918D53E54716FD489AF4F123B2ACDCE26AC69B4FF85EEF75837348820241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "d1b02de0-8ad9-4829-bb4f-1c6c6ed7f0ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "50de044c-0680-4e95-8df5-3d89ac852f9d", "value": "24576:csypuh8y2D8aZ2z4P6j39HqyhrVDhOqx4:csypup2z2z4Py3MyhJAqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373662, "uuid": "840b9783-c235-43c8-b625-7959f19fd363", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373662, "uuid": "aa865ddb-89a1-4b97-9d9e-1c96ebda3022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "e989add3-4dd7-4a87-848a-4c54461abfdc", "value": "2598b0f8297dc652e3fe52b3912895d9f81f6435ba0f7ffa00d71c491fc914a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226ca04f-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "1b50de22-797c-4305-881d-0a05829ec861", "comment": "Malware payload", "value": "9e86919ccc1e4c30a31759c5499f502d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "94933ba6-eecc-4146-8f55-e6abe6985692", "comment": "Malware payload", "value": "2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "91ff624d-1b55-4180-a8a5-2f191d5c10ca", "comment": "Malware payload", "value": "df1028078381265acbc763c11a0ae723b9bbf05a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "a12a3255-2a3d-4e0d-a1e7-0de12c000f54", "comment": "Malware payload", "value": "0f7d0ed5fa58864c87028a404073d5dd324b4d90beb284664070adaa8e5e93046d14ad3a67e74c75c1a54030ab0f558d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373560, "uuid": "73447c87-7bae-4417-a214-4ef02d67f44d", "value": "T1CEC28D956A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373560, "uuid": "6acf3e53-2051-42e5-907a-50138e38aa36", "value": "768:b8vCB+25j6es8Rp9FYpMSUpi+20qUpi+20YQX:b8l25JPd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373560, "uuid": "314f9a43-8d9b-43ed-b95b-64c2272a53d9", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373560, "uuid": "6eb545fb-98d2-41be-9c5f-b8d6fea5141a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373560, "uuid": "3a1d7519-8f05-487c-bd8b-3857e840bf3b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dda0a67-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "56527d8e-d7fe-441e-93f4-51247cded155", "comment": "Malware payload (Vidar)", "value": "a05271673f0563cb290da455ade53d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "ea74bced-e93c-4cfc-8e92-b8e076baf3fd", "comment": "Malware payload (Vidar)", "value": "26bcb076eb027815530ed04dc3edc4bd5bb694dd77a10a0aa87f14b405123486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "150124a5-6759-428d-a466-96e04dc7b46d", "comment": "Malware payload (Vidar)", "value": "8dc9ff2be1acea02099ab0058471fdb594eaf2cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "20d75b63-3c09-4107-8099-113c0a3cfd0e", "comment": "Malware payload (Vidar)", "value": "ca3d7811f00c1a1fc982554abde3d85023461e0f1ea39570a47ce97274104eb37b03eb2eb9c98dd9cb7f389955d3121c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "2c23012c-8ad4-4576-9841-b935401d0c46", "value": "T1D54501242EC72B48D97D0F78C16A1888ABF5C5439312E7EA7EED01F4DE72786CD26416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "47cfbfe5-d5e4-4a69-b09c-c292bc5cc3af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "59b99ece-5204-4c38-ab86-4261d01aaa2f", "value": "24576:uq4OC48Eq5Km1Z/rM655yJmg6K4lOVALNUSqkQOq7:t4OC4qDZ46OJmg94EALmSQOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371082, "uuid": "521ad5cf-299d-4be5-a4af-34998da7dcdc", "value": 1182720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371082, "uuid": "34ca05cf-c422-4a8f-bf1e-e0d48614d103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "8a1d9da7-150a-4497-8bfa-d73078ab0d96", "value": "26bcb076eb027815530ed04dc3edc4bd5bb694dd77a10a0aa87f14b405123486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdeb950-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "88c4ccfd-b038-428c-bdfd-0300de8dd74c", "comment": "Malware payload (Formbook)", "value": "96924e7ef128d42f420749c681d49750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "80c4d628-04ef-4248-8da5-c1a0a3582b11", "comment": "Malware payload (Formbook)", "value": "27049c68d4d7422d51737fc4dd9ed5afeb348c130f4ffbac24817fca94902625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "a0a74973-6c0a-44d5-af83-8ae2be3acaf4", "comment": "Malware payload (Formbook)", "value": "1be16572fe13cd5b881379ff96ef285f64efea92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "db03aaef-5c1e-4bae-9204-9d19ba914ac6", "comment": "Malware payload (Formbook)", "value": "07431284a3f077d7012dcec93649845cfa30aba112701f51036098dc3cc07db4969f9f5618f025a15f68f0bf320b5945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "a4810926-de0e-4bca-b82f-f0e585cdf5d4", "value": "T116351248AA49C810C5C70B34C860E6F603F2AE6DE521C69B4FECBEEB7D767016D14B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "d48674e6-7b47-4ebe-835a-d703d86d924f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "65d09ada-daf7-423e-9a40-aeed5ffebeef", "value": "24576:0kTz3kiKZGtP+JWavhDZcDN5oMPXYGKvVKY0PxuDJBQdJHVQ6BTt:Jv3kJvhK5jP3KvsYIxuDJB96BTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370791, "uuid": "071fa0e5-d683-4460-af72-d4f1c1ef6081", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370791, "uuid": "48fb4457-ed9b-4f2f-863d-ecb9c5ce5332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "4d150beb-9ae1-4873-b630-1846f022b066", "value": "27049c68d4d7422d51737fc4dd9ed5afeb348c130f4ffbac24817fca94902625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf12696-94e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786385711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "eba6c428-06b3-4885-9ee2-a74ce6c9c99d", "comment": "Malware payload (Stealc)", "value": "03b6ed7086933a7082905360bd9803d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "b3fe25e0-9a0e-4eb3-8622-7178b1964fa8", "comment": "Malware payload (Stealc)", "value": "2722e3fa2347b1a5c39b44773baa719a3bf1414b82814b780a5872e21cd3c9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "306aa632-ef2f-4cd5-899f-bf12dab7b635", "comment": "Malware payload (Stealc)", "value": "1e33f322e55e90b4ac5be3594b4544a7f87d2397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "7cc9b84f-b5bc-4f41-8106-b1ccbd6d5b95", "comment": "Malware payload (Stealc)", "value": "c5de4624d25ae87e38ec79e765115a21db8ada52dabd0b0e7fe4ec87dab8ba4b71b9103e07834a2c02637de0589bd1aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "68a64032-4d84-4226-8773-61134714220c", "value": "T10115233221252C9CC723C57381B24BB560B2EF1151617A736BC0F6366C69D286F3BEE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "7d04a974-5011-442c-81be-3108b41f240f", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "0458959b-283b-4caa-8a39-e78b80504c98", "value": "24576:JT9r/e2goEAxS0VGzwYKvIxDwxqUVKYCSt9X7:JTZ/e2zEWGzwYKwJMDCSf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385711, "uuid": "c98dfb79-6322-46fa-a6b5-51048a797240", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385711, "uuid": "d2b7d6e8-e6fb-47b4-a236-31a80bda23a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "64bc5074-2fd4-40ba-9ac4-1b615a42c92d", "value": "03b6ed7086933a7082905360bd9803d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d10e72-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "28b9f6cc-0ab5-43f9-b8a2-5d8fc5cdc55f", "comment": "Malware payload (PhantomStealer)", "value": "fc2d8dad7482a6779f49e6e7c499164a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "64091260-419c-4d29-90c9-25e7079e72a7", "comment": "Malware payload (PhantomStealer)", "value": "272cadb67ea6d46e4f4e9219ee8fc8449fc6e2c2cf2ca4cf4303f02c9f00b21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "1515d4cc-41f9-4ca6-9cdb-3a9d47c74f99", "comment": "Malware payload (PhantomStealer)", "value": "bed4b6425baf7b6f9b896be8b5ce45092c083086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "fcbc9dcf-faed-4429-9fa7-5205f7d73c66", "comment": "Malware payload (PhantomStealer)", "value": "1847b3699a5a1b187248c73ba1bf3b780d4157b5dd8ac89f48c3b5d20a9de0d23db3a2af1406bf684d98de5975aa0420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "31585461-01a1-4d70-9e31-4d7045a4defe", "value": "T1D645F150225BD842D0E687B3A8F0D37422650ECE78E3C29B9EE56FF735153C695A8782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "64d50a24-1e0a-4eaa-afe0-6fff3704d531", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "04c355de-eccd-417f-afed-8a072f01e371", "value": "24576:Wlp50BpDQY3DLFTiKwkIU6yC3DJ97s0G+Aw56cSq8pqrD:epUtDLxi26yC3D/w0H2TpqrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373005, "uuid": "2eaf78f5-bf18-4cb4-a2d8-f4ecac33e0d4", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373005, "uuid": "04f70952-5e4f-4863-a6e9-662e8cd7e43f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "b338aa10-dcb1-4adc-a8ea-d31d43199124", "value": "272cadb67ea6d46e4f4e9219ee8fc8449fc6e2c2cf2ca4cf4303f02c9f00b21c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319a92ac-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "424d1b55-e69a-4925-8cd5-23ca614b1bcf", "comment": "Malware payload (RemcosRAT)", "value": "20476f3a51dfddf3dc0603fc7858d894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "87d93c4b-b8d8-4e3d-b0b9-a4999c421509", "comment": "Malware payload (RemcosRAT)", "value": "279e14ad7bad135f7b63e17c355c969116c2db600967061bbab107f66d62dbb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "f0e707f4-4ec7-4db3-834c-be1465784c23", "comment": "Malware payload (RemcosRAT)", "value": "8473528eae1e7cfaae6099b45260b9c576275bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "28c263e2-425d-43e5-9a40-bc59af039816", "comment": "Malware payload (RemcosRAT)", "value": "5f3ebe179a246d8b407d82f3d2ecd69a06effae17a1510c151e4d5571f3a9290193516650dd1370cb601838dea64fcbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "5ff8fe6f-b153-4d3e-9138-4e3994e08937", "value": "T1DD0512507A4ACD12E5D31FB148B0F37916707E5DE600CA0B8AFDBFDB782AB4AB809551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "b94f472c-ca15-4d96-899b-9cd2ce4e141b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "df8a8a4d-3605-4cc3-902d-aa7bc0f75f24", "value": "12288:c3ZIaopA+Vuvmwt715Qm+b9ggacQ2qCAm4n1K+n4n3SfozoOyzgN:cpIaopFK9oT9gg2nCAm4n1L4nCfozgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371008, "uuid": "720f7bea-ec16-4c00-8be8-a019f6acbba7", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371008, "uuid": "ae719284-8388-4388-ab4c-603f0f826285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "8c070f42-38b2-41c5-885c-7dcea1b33910", "value": "279e14ad7bad135f7b63e17c355c969116c2db600967061bbab107f66d62dbb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41f4c51-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786368677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "c11f19cd-f61c-4a37-bbcc-8794aa91420d", "comment": "Malware payload (DarkTortilla)", "value": "d4a282502964d2de15b2510adcaaf33e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "3210025f-2d32-4738-8700-b1e9b8c34d20", "comment": "Malware payload (DarkTortilla)", "value": "27be960b02569dca8559acbb4fc8160ecea649123c7addfece87f09ff93fb2be", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "a837628d-2d8e-4b13-b148-268b30548de3", "comment": "Malware payload (DarkTortilla)", "value": "99a8bec19f2548972a7198b3ee687a0c04a8c834", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "2aaf32a5-579c-47ad-b768-61e70c2656f2", "comment": "Malware payload (DarkTortilla)", "value": "06c1121a673c9ec41f502f582923145b7400049aa35c4e75880d04f939d605c13a12c83507c4593716b2a773eda67a1f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "0fdaad92-e1df-4f0f-a02f-03e184883d9b", "value": "T19385F11A5CC326D1D5BE4FB4D3A514E863F095178285E7AB6EF802F4CE92B8BD907063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "56237e34-9289-42eb-a13a-efd7a2e6f7a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "7bef60eb-3c81-4499-8fce-60ddf3e09468", "value": "24576:V0/vylA83Tge0F7UHx59pVXHEhWKSv5on2kfzwTrEekuEKPhZQLOHM:2/vyepFS9VXEhSv5oAPGeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368677, "uuid": "acb2ff0d-3b7d-49fc-bcf2-12cf002c381d", "value": 1768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368677, "uuid": "299c1273-cbdf-48b0-8b8c-43d85ff088fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "ddd0d071-6064-44f4-be5f-8a566a77f719", "value": "27be960b02569dca8559acbb4fc8160ecea649123c7addfece87f09ff93fb2be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49dded0-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "c999f57f-f870-4a37-923d-5d3ccfa6c3ed", "comment": "Malware payload", "value": "e518ee98976ffa1d837a556a6e4ad461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "caf64942-4b83-4eed-b75a-35d5fd0b8545", "comment": "Malware payload", "value": "27c7428f9e61eb9b21251cb0d9e8f5c2ea7fa41091a174158581ba577c3f1f74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "d33d363f-0ac3-4885-826c-34467e7b04be", "comment": "Malware payload", "value": "150a09769fb4cee6aecf3e4e89c0e2f4087bc9cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "a58aadd9-7532-4c75-8950-ea227951491f", "comment": "Malware payload", "value": "c74f72ed5dd8600107e06b0cf2ec1a34d94e3036bdd530bafc08e6999a5ac25bd08b7cc79ab3527c77754015be78db94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330426, "uuid": "084c7a11-580d-4c59-9d65-23a737d58720", "value": "T18A233B46FD268720D3A216F05FF55A4257506E6638D33300DCA8F73CA9AD0A86793EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330426, "uuid": "949032e7-7f9a-40e9-b1d3-2c6de8cf5159", "value": "768:jfWK9VnF5P9HrABmvYhuTBwBpbXSQS9rg2+5alXjtrsvQXM/lTnYuH6yzhxw0Zng:CK9tPOm143oqmMtTnXZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330426, "uuid": "c258b9bd-c21c-4a22-b61d-bf677812023f", "value": 45948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330426, "uuid": "0784b648-266e-43f4-b881-bc68dec2da55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330426, "uuid": "84f75079-d8b4-44f1-b7b1-cdc908c6d8fb", "value": "main.riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c43a5fb-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786372449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "9c1ab418-f491-4c29-95b7-bf875664e151", "comment": "Malware payload (PhantomStealer)", "value": "b8f5f0809d710a63915948e4734026ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "e8378e26-bd4f-4f61-94a2-46262b901e4a", "comment": "Malware payload (PhantomStealer)", "value": "27c7afa7d8d8a164b08778b419118dadc8fed4962d0fada69f5883a266df8444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "b7b8594d-7288-4541-802b-64e93aec7bf1", "comment": "Malware payload (PhantomStealer)", "value": "4353aa814e998df4c6cdf59aebc5efce9d7c57bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "c36bc149-dadb-4444-bf3a-9b7aacd8859d", "comment": "Malware payload (PhantomStealer)", "value": "4cf5857575c3f3d74fddead7c775dc086a67ecc0e024f5ab0182f59edc9525b41fe853ab742456557a8ce2223e330a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "74cb108d-dd1d-40d3-9238-151177596b54", "value": "T1E6451255E7EBCE15C27447B048E4D17003B16E4DE422D5870EE9ACCB7A22B9B4EC8B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "2bf08284-9b68-4769-81d8-442773c96dbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "55268a4a-910f-4482-b469-514c5514003b", "value": "24576:xjsj/Og3p1v/V5H0Q1FmvnvxS4p8kfj9xMbGxCFQEd/B/0ZkM18pH:52PjV5UOIQAH5xMECF1d/10Zkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372449, "uuid": "78c6e716-7f12-4472-ae4a-06a484e5296a", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372449, "uuid": "d5f4a060-96be-4f33-9f62-becd9441aa77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "7bffa951-c6f2-482a-aa39-17a305be3aa8", "value": "27c7afa7d8d8a164b08778b419118dadc8fed4962d0fada69f5883a266df8444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a6d4a3-946f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "e3985332-81d7-453e-bcf3-0b5b4ef7949e", "comment": "Malware payload", "value": "f0ffb9a35887284e4f2a1b6176e706d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "33dda916-af46-4eba-9785-62d9783a83f5", "comment": "Malware payload", "value": "27e13c5fbb4a1193189eab2ad5e9733a80c69a4543c095c8e51dee8caf900e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "3373e198-26b7-4544-a085-5905efd39466", "comment": "Malware payload", "value": "57b96817f20e4d8106dc20eb9c4514cb3db7eb11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "83debfe6-ead1-4aae-8110-eba6aa893e46", "comment": "Malware payload", "value": "f8131eb845871a561f883b4a0b1301b883983e05de39c2bfaaf789d6692ab21357351c889fde2f7384d23103cbdda04e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334323, "uuid": "606c349c-3ff7-4a68-84a5-d1de6162e01c", "value": "T13E63FA06EE916AF7C01ECE70952DC24A01D65CBE92EA511E71F8C98C7FBD3564AD3C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334323, "uuid": "86606097-aacd-497e-8847-b4c89faa2057", "value": "768:li2MzqiR0r2tnXPjXHdAs5Z6trX5iMqul9GdPmQ+NjO4SlU1hduc:kR06tnXb5ctz5iMtluY/7sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334323, "uuid": "e26bb43b-7971-4202-b03a-48b45e9686f6", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334323, "uuid": "149e8486-7df2-474c-a3e4-a22ddff5a421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334323, "uuid": "eeaadf1c-92f9-421b-8fc3-dbadc5f8d204", "value": "27e13c5fbb4a1193189eab2ad5e9733a80c69a4543c095c8e51dee8caf900e23.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e18097-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "49fce97e-ea32-4e1a-8132-5721a8610fe2", "comment": "Malware payload (Mirai)", "value": "672efd85f0b144c662941a62f14328d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "e576df79-4c98-4c1f-9cfa-97f0ffc98a71", "comment": "Malware payload (Mirai)", "value": "280ece3234a3dfd3fd033df71d11afcbc08109164f36b8acb6afe8b03b81c1d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "4bb817af-bebe-4e5a-bff4-b2335bb22694", "comment": "Malware payload (Mirai)", "value": "28818f0451f9dd61762e60f06212f26e58a88f44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "22ae2fb1-e5e6-45c5-b974-90ad56962b61", "comment": "Malware payload (Mirai)", "value": "da0f5e1250aecac028a4ca17cf1de3071288885f5e4006cd28c782947b87a429ca6bffd4a10b5c55e5ed89d899441d8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353827, "uuid": "fc07d616-8190-49e0-8354-a224f39ae337", "value": "T1E9F34B07A8655FA7C589AEB566F75A340753E8110B4F0F8AB23AEAF406079DCF40E374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353827, "uuid": "dd4f91e7-787a-4828-bace-bc83681ad132", "value": "3072:K7CL9hXpdAnqsTZ6UO2s90WRhGcIC0AzIC/L+5vCBv75xXBT2aLf5FwD:KWZlpdAnqsTZ7OXtRhdzdICDmvCBv75Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353827, "uuid": "b7bddda0-79f6-4f8a-8b48-3edcd6bd475a", "value": 163019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353827, "uuid": "0875572c-323e-4925-a2f7-7f672f3b76da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353827, "uuid": "65f32b55-0dc7-422f-a5f0-fa1363ade5ec", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4aa7d00-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "a698c859-2876-4e47-b178-a33f5467a189", "comment": "Malware payload (Vidar)", "value": "ab62b4aa0594fc562bb9a009fe6f4d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "0246c100-780c-4a0c-ba30-66e0017fd55e", "comment": "Malware payload (Vidar)", "value": "28102ff5a36c9686d643f98376acbc4f322faf61dae44c72b6970fec4bb31f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "a0cb9ae4-fa2b-448a-8209-def3e6fc2593", "comment": "Malware payload (Vidar)", "value": "020d3ca87aeea500f95e6e3b63b98a2a52d86367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "7a4ad62b-ac10-4f61-b139-39372623cf05", "comment": "Malware payload (Vidar)", "value": "98bbf017b50e37971319f26fe177f3f6393454c5e86e34b2cfb7d624c568c444bd412c75a90784bf06cb5413dadd221a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "72e1af5b-15cd-4e04-b6b9-383b23eb1149", "value": "T13D520BC774C320F9D0F88378C94F5ABA8A267095271E9EFF46DDC51432E2A511ABCE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "4da3c73f-cc3b-4791-8ba3-76bed190524e", "value": "e489cd9c73beee1db4c320380f37924e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "5f1ef35d-7bfe-4a4b-8e80-f26fb9486ef6", "value": "192:OZ4X2Q5tDt49Ewnhe8soCk9wTAl8o8V2/bt1xxd167B3Vd:OanJ4CwnhVsoPCmdn1xxoBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371282, "uuid": "b8cbc749-f4f3-48c5-aeea-3f25f96982cc", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371282, "uuid": "b96d59c5-5fbd-4631-88ae-9b862a916dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "c843c1ec-e353-4368-9a3c-e3b284505554", "value": "28102ff5a36c9686d643f98376acbc4f322faf61dae44c72b6970fec4bb31f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3460cdb-94d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786379064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "030e6b0e-16ff-4866-9feb-ed82bc6fc24c", "comment": "Malware payload (PhantomStealer)", "value": "608d29acfe6b1fed236edee902f69c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "642f7351-f405-4ca7-b6a0-2b4611a8abbc", "comment": "Malware payload (PhantomStealer)", "value": "283457427a1f20a6a9807220f489910f9e5130aeab73aac82df07f1c690651cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "6a10e16e-61f2-42eb-877c-ff37d2464057", "comment": "Malware payload (PhantomStealer)", "value": "4d13d393f6569eec20053d2e3512552c8d3e8287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "2cf934e1-53c5-465b-b394-a541724cdde4", "comment": "Malware payload (PhantomStealer)", "value": "e3fe08b3c9233874fcc66a177c8d5290b3657a03ed919ac2d60a8629f199cfb31da0896dc247dc1322cb995beb77dccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379064, "uuid": "364f9b28-f811-4dd9-bc42-cda489bd7a5a", "value": "T1A606D64127449D72B72DAB5CD13ADAF09A5A611314C5DF1E30ACF2087B6CD0BA79CEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379064, "uuid": "c862aab8-83f8-461d-b6b3-8432bd4c0cda", "value": "98304:McrcxAxkORiADeM3u5gvb3tzyzD1bJ0E8S31Shtmp8+dTWhCfoMObgszXqzD:DriEeEuub9zeDlR8S31SHmp8+9cCuzX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786379064, "uuid": "4d20795e-6eb8-4f1c-b528-519a54ffaedd", "value": 3664134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786379064, "uuid": "55745f80-0506-4668-9dab-26a4d5937509", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379064, "uuid": "73846cff-f5df-4537-9a54-5ce85bd1f90a", "value": "STATEMENT OF ACCOUNT_CSCBOS 202607.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf7bc58-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "4ddb1660-f948-4e6d-8f89-6a6f169334c7", "comment": "Malware payload (Formbook)", "value": "af4e455993cd83b4832fc452a9955cab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "d70ba306-eba1-4fe1-8077-f97aba8c2395", "comment": "Malware payload (Formbook)", "value": "284040a981976a9b34622bbe6d0c05a4a1da103e002a8268750d966847c47912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "d2bbb074-6ba7-4341-ace2-f579b9bf24a9", "comment": "Malware payload (Formbook)", "value": "2055d784a098cdcd1daa22c03f902ac17a2c95f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "c0a289d2-5353-4fb5-9b98-a5b0ab0ae5e8", "comment": "Malware payload (Formbook)", "value": "6d47777584ca413f59e2ef4d562b751626beebece2fd2ca8ccb5e48c67631f54e3cf7d37b15030f62bdca4817afb4537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "6dcb3d37-26bb-4d8a-b53b-ae715e4b28ba", "value": "T1772522282208C607C89627B90AA4F27C13BD1EDA6422D3376FDDBDEFB932F555C51192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "81b0ed9a-8775-4c6c-b529-8ff8c8e4b275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "0346bbb2-17e3-49b7-b88a-e83a49dee189", "value": "24576:Kbz6pm7gqkW3NDrtFbkTklgbudqfVrVSjxpYVx:DM7b9JFbkTkYV9rVSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371564, "uuid": "6d4de8cb-705b-4c12-9702-9a8a2cabe17c", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371564, "uuid": "c8061118-0554-492e-b93d-3416fed522e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "2c7e9fdb-51b6-42c8-94e2-425548d831d7", "value": "284040a981976a9b34622bbe6d0c05a4a1da103e002a8268750d966847c47912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cf5644-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786328868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "4c5619bf-62bf-4ae0-a342-e91ca9e35ed0", "comment": "Malware payload", "value": "9a080c35fae733726bd422c55f81e7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "5caea1fa-d587-495e-9b79-bac789a17f2b", "comment": "Malware payload", "value": "28453e3796ae864a07efceb26f881c2d3d05bcdb95012b817e8dfe9fdc5eee34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "b66df956-06f2-4eee-b79c-dd74edbd66a7", "comment": "Malware payload", "value": "63ef4fa804d8920c01e2588bb26bd765e648ea69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "01fd84e7-b9ff-48d8-b98f-0a87c1bc7879", "comment": "Malware payload", "value": "69f12d6b1245bb9c9be093469b89827a44e399b4c6f8bd260e944b363dfb69b0a8922bf21bb4a6671831080843b63c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328868, "uuid": "edd6b615-1761-4544-a8f0-5c7632e44fdb", "value": "T11E631A7A7711AFA9C26CD53009F28BE58AF21A6325E280817374DB0CAE7151C2C9FDF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328868, "uuid": "df214ece-77a0-4ab9-8bbc-c0255e0b6d05", "value": "1536:pidZZug3zU+xUBMZraMGqK5QiXEzEnkApGz2cs85eWNfFKEV+jOPf:MkAz2x85eWNTVi6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328868, "uuid": "a7204251-a550-40f6-99ea-43767d9bbfed", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328868, "uuid": "bfcf609e-892e-4a74-b4a0-fb4808747512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328868, "uuid": "52dcbdae-647b-4b32-87ba-24efe5f559da", "value": "main.mips32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf751b5-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "5d0c2c9f-0599-4421-8a96-9c22fb140d7f", "comment": "Malware payload", "value": "bb1ea7517e2dde8f1db1d989d47eee57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "ccd619f7-c34a-457f-8fad-79fbf12dbbda", "comment": "Malware payload", "value": "28b4d64ca9b0fddad1e87ef8d31a0b79803e34d26b53eeab205b851ab4f1c391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "68b5bb66-8f85-448d-8b38-91f3d3ffad6e", "comment": "Malware payload", "value": "e5d6a6a2e6113f8c846281cc2a0d7fdf07102ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "0ddca02b-d781-44e2-83ea-818c64d5f89e", "comment": "Malware payload", "value": "3d8b4274dc120393a5bd5ff071538554de286d4f1cc97c0ccfe0b7e8e86a40f668c0afe9abaa57e5cf55f43fe1c9698d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397010, "uuid": "e5472763-798c-4f83-bbf6-92d7f0b2a7a2", "value": "T1FC53081BB5E3B0BCC297D0745A5AD9B2B9317CA002213E7F97C8FA312E35E016759A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397010, "uuid": "851647e3-2d46-4f13-adac-eab248492a27", "value": "1536:sy2ocWz/ZrJmc7G0kOxok/ZOQeh37ygor6kNzeUr:sy2gpJmcy9Oeh+rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397010, "uuid": "7d73b85a-f832-4e51-b4c1-8226f661e3f2", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397010, "uuid": "4e4610e4-1538-4cff-8b88-6dfe65ee2cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397010, "uuid": "09f19f03-aca0-4491-aefe-77497e43b2b8", "value": "main.x86-64-v4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344deadf-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "9f819eb1-723c-47d4-a734-dd3a8f00cb69", "comment": "Malware payload (Mirai)", "value": "d0bb355df43c596493f9b735542c95e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "b2cd196a-5c36-4479-a6cc-e63d2a192cd8", "comment": "Malware payload (Mirai)", "value": "28cfb803149a83d652ebdcc5303b4c0fe9a7bf14e083488e0f9e2808b08d470e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "0b596d8d-0937-41b3-a124-a9e2b16f528f", "comment": "Malware payload (Mirai)", "value": "6b20f45fc0c70043c2052b6ae1bfbfa395136b96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "413c662f-883d-496d-bed6-5ce163349ca0", "comment": "Malware payload (Mirai)", "value": "f61961b4925395b5f4d3bdadfc195d35ee6b21200d83d15dc1c14116cafbe656063f81d3a12e19ee49bc77d7f686955b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "84d1363a-799c-485f-96d9-17667b9787ac", "value": "T1A6144A02732D0D07D1A32EB0373F27E193EF999221E4B545299EAF9E8075E325945ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "39cdc8e9-18ea-4bdd-901e-ef1acf530165", "value": "3072:ktpa1/GKvNsngJ0L6H21zRuWqjDPkxpY76LPCgWiU2i1wdn:Mpa1eKv+gJk6MRREkxpY76r2iViqdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356839, "uuid": "0bb7e14b-6901-4736-9cee-c76a795f70fb", "value": 200816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356839, "uuid": "a2f4b520-5533-464d-903e-ada5573f95ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "4cfe1502-2944-4431-a954-43c57a952fa0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0a0528-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786345763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "fa221763-84b0-4332-84cc-6a16fe4acab6", "comment": "Malware payload", "value": "f1a0e92f416b0661e414686540b6659b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "bc8a4141-9350-449d-a6fb-f89b295119ad", "comment": "Malware payload", "value": "2956dd88242e6d0ca3c2e3d6337870c766519a5a0a30ca563dc74c1cb5d2cbf2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "d4de250a-223a-4021-a6d6-ea154b0bc2dc", "comment": "Malware payload", "value": "50e0b1e430a38a2a9d1768f0f2029b33a50138c3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "9562f082-a3ae-46ad-b745-fb90d079d1f1", "comment": "Malware payload", "value": "30b5915af3a749d320e41c0d2f987e89ae3d25cc70eada41f99ce176eb7a7eef0deb63fdbce6b115e45ab0ca07834226", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345763, "uuid": "d7add566-7f63-4beb-bf21-95f2d17033a0", "value": "T1B9236D651A857C24AA98C4371D7E2F0CBDAD43E6324492EE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345763, "uuid": "8f88b041-7875-43dd-962e-0d4f22b19db7", "value": "768:pXRWNGxVP9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jlxWcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345763, "uuid": "30d2fe6d-a9a0-46b1-a33d-ba0a6a7d55f9", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345763, "uuid": "2c035a6c-2b4e-478e-9166-0a8ce7fb2e4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345763, "uuid": "1e7e4713-31f7-471c-988f-5d7a306479fe", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99abd112-9472-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "f92b5250-b123-4469-a1fe-8934f11d3b4b", "comment": "Malware payload", "value": "d9faeabbeaf8cf5490937492543a7333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "c26f97c2-0985-4683-9050-482071f32970", "comment": "Malware payload", "value": "296a6b701c26c5eb323efdf168f54d6125a522015882d407636b0bf7a26f8533", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "1c564ab5-b230-4316-9b5b-388a837e6bac", "comment": "Malware payload", "value": "8c27ec074cbf17bf03065b9db922969eafe35410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "485e29de-4324-4ad3-9c74-b9522641f7e7", "comment": "Malware payload", "value": "877573a843a2644963c30755045b57497f69e526e5bedea3a81c7906be2b08bd638bd6916eb7ce12737af8017f916268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335535, "uuid": "ec29b5b5-fb26-43a2-8010-59ccc6de2f7e", "value": "T11C23D417B6A3B0BCC34BD1744AABD5F1B8317CA402213E3F97C9FA312E359116A59A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335535, "uuid": "b944ac57-afbb-4fb4-85bb-69cb36119106", "value": "768:RMyc5MFaiMn+m1D9UDx1BeMHScRVZp4tPQuLn/ITljMJ:iyc5MFaJJ6nB7ycbZp4tP5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335535, "uuid": "7b26c292-b3eb-4659-aeb5-589af78e0358", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335535, "uuid": "b1a9e376-d9cf-44de-a26e-1e9e30aec2a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335535, "uuid": "79c2431f-50dc-4440-a19f-6f4c4769f8d0", "value": "296a6b701c26c5eb323efdf168f54d6125a522015882d407636b0bf7a26f8533.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9db499-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "a57541b3-7b40-4e06-9e4c-baa2ce03f48c", "comment": "Malware payload (AsyncRAT)", "value": "bdd71bb539dcddf10bfccf3e1449dac4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "c79d3352-4aae-45be-8961-76d08862b61f", "comment": "Malware payload (AsyncRAT)", "value": "29bdae0aa26b6ed72a2ce493fcb07b1464ee00fc3dd88f2f07f47c63aa8e0113", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "c16b5f7f-cf25-49cd-b1fa-01e8535fc8de", "comment": "Malware payload (AsyncRAT)", "value": "f53acb5395637e6d8383a54967e4d8809ee1206a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "a8381ed4-d761-4d6a-a4f1-88ed8cde6f95", "comment": "Malware payload (AsyncRAT)", "value": "e3270480f5fec00a6e33278a491156168bb6e3fb9a559ae56e724e0de3af184de9df1901b2a14933773ba92ea345aa9d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "7c5d3758-4ccd-49e3-8beb-a3b74f519ae7", "value": "T1A1F4129C6649EE0BCA5523B50A61F1B513AE1CEAB820D763AFDD7EDF7923E044C040D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "09891264-9d38-4e8e-82ad-d5d6c13a1554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "2d8acaca-c805-4011-ae9b-e1cd97013144", "value": "12288:olJdbk0ItSS+Okqh4vKbEKkffz5YWAVu4PNHwBKkiDrDHyYS:o630kJEjfz9guZ2DHSYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371622, "uuid": "0916ab3f-5e3f-4591-b9b7-cc5773f112f2", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371622, "uuid": "9d68bbe0-3f11-4411-830a-4b842059dabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "5e723b19-1977-4b95-a9f4-727fd66a803e", "value": "29bdae0aa26b6ed72a2ce493fcb07b1464ee00fc3dd88f2f07f47c63aa8e0113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1923e605-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "27b0ab9b-cd30-44fb-bdc7-db96fb7f0e9f", "comment": "Malware payload (Vidar)", "value": "6126a7bba9377499185ef39649b65652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "75389636-82ff-4166-bbc0-330b2a13878b", "comment": "Malware payload (Vidar)", "value": "2a014bc6af2e26c3ebdfe74e105f65c09f6edc818e0e7610f5b1d25774090437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "e0759f45-3d7d-43d3-9717-1454e97938a2", "comment": "Malware payload (Vidar)", "value": "e9ef6d8bac501c5201b10252e5ad57b79e3218d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "addd06dc-474b-4735-997e-f79eadfefff5", "comment": "Malware payload (Vidar)", "value": "de942ef036ee584b981738872d5391b7c1260256682f9f2c2c925cb78b32cad838bbeacd91d75cfc631aa6e1371208df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "a2e19dc3-56c8-4716-9327-9e86d148649d", "value": "T12A520AC77392A2BDC06883BCC69E22E7DB24309417169EFFA2DCC58457C25407678F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "f35bb9d5-e0db-4a92-b76d-f0ab1b9e6745", "value": "6dc49e85762e4ee01dd5464c00241541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "02483f86-e415-4362-9973-85f2a6076157", "value": "192:Oih/xokuHUGrSGMzn/vgsc1Y7MKXwuR2EovjQaoli4CCVF053VOjl:Oih/+TDGGe/Isc1Y7b4BvjQ19CvlOjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369249, "uuid": "f54032de-ff36-469d-8020-90ba101ffaf5", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369249, "uuid": "5158843a-6783-4431-92a9-2f38a1646895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "a47a3671-657e-4f58-849d-c6da8d18723d", "value": "2a014bc6af2e26c3ebdfe74e105f65c09f6edc818e0e7610f5b1d25774090437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf07890-9494-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1786350168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "ea918e5f-8ce1-4d7c-98d4-45917f0edef1", "comment": "Malware payload (PureRAT)", "value": "325dd213f9a6f78e41cad30c49e0a178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "ef339b0c-275e-418c-a5ff-1ba7ed7877c0", "comment": "Malware payload (PureRAT)", "value": "2a167fbe58a9d874dda8798e9b0d773d9316a217256a7e3f1d0c5e3e26f9f03a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "5d98bb96-9732-4357-9256-7672600ef33a", "comment": "Malware payload (PureRAT)", "value": "666974fd5ab2ab200c8c87e1945708c9e4f2e76e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "2291ad98-755d-4938-bff7-d035053bd04d", "comment": "Malware payload (PureRAT)", "value": "4dd3fbf117799092a054f0d8031d970f8940e7a90ab64dd8ed0df50993f1503653bc5eeb52c21792bec9b6ecb19a1219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "8745e6d7-1782-4277-8282-93407fc59ee1", "value": "T186649D5823ED8A26E6FD63B5E83D040D47FAB51A612EFB4F1AA010FD5C13B8489017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "2f10cf10-03f9-4730-bc47-d88a733c54ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "be26bfbc-f146-4725-a32a-1e582e491375", "value": "6144:C1w1LLUxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:C6Pu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350168, "uuid": "da0b68ad-cd67-4240-abff-d95621cbf382", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350168, "uuid": "d69aa87f-3c0c-4a71-9094-ad7d6eb73629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "b4d1dcef-8089-40f3-9ca2-eebd2cf4f850", "value": "325dd213f9a6f78e41cad30c49e0a178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0ef474-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "ab042b26-56ef-47b1-93c4-d77d2559709b", "comment": "Malware payload (Formbook)", "value": "bb5d228a6918a16e275839a7eaf2a58c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "f923a58d-5863-4f9d-8b7f-94dc0a4ce5de", "comment": "Malware payload (Formbook)", "value": "2a18b3492f1ba54315d620ce3e8be895a22f220f7f4d6d2c248327351adfe2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "f8bb419e-167f-4c40-bd4f-fc4dfc5d0825", "comment": "Malware payload (Formbook)", "value": "8ddabb59af4aec311cb823df80a612d01e233bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "8c404a4f-a81f-4077-8677-b94a92df8894", "comment": "Malware payload (Formbook)", "value": "c7079a47605db2a107d3e6b1617880e95167ce42314bf522281170bd32b0ff73b848c4be881333eafd6cf6500bb41ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "752cc10b-6207-4a2c-95f1-bd84f39de1bf", "value": "T18B252228579DD112CAC687741E75F33106BA7E5CB020D32A8FECBD9B3A33B026654796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "416236be-d667-4647-bda3-74887e4b129b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "a9cdb3cf-212f-4285-a93c-6ad8f10d4406", "value": "24576:bX9Q4jERuqzprrl253vw7PjBoVx2G7B41gGZ9Ab7AV7:btQ4jo5MIjeL2qqtwHAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368799, "uuid": "0651bd61-eb15-493f-bb86-472c3a8a9001", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368799, "uuid": "a4728182-a7b1-4c06-8c5e-ec9f843311ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "5bcefe19-6275-4a4d-beb6-3dcd7a03d8eb", "value": "2a18b3492f1ba54315d620ce3e8be895a22f220f7f4d6d2c248327351adfe2fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3e4e1a-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786371514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "378229e7-cb58-4b06-8f1d-0aad964bcfd3", "comment": "Malware payload (PureLogsStealer)", "value": "4e103369276ff0b62a8ec99bd95dfd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "f200f802-91b3-40d4-beb5-040d6cd9f4aa", "comment": "Malware payload (PureLogsStealer)", "value": "2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "8a453c5c-4166-41f8-b470-d06688988899", "comment": "Malware payload (PureLogsStealer)", "value": "a8d5d0882d133721430c6e437b1222b40fe7aa4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "ddf1ee11-2d94-4941-aaf0-4a0a2c6c5ec2", "comment": "Malware payload (PureLogsStealer)", "value": "ac6e94d38d3b6704733a7eaee0df3b07a41437feef80444799820948ce6988d5878d28641abd13bfda56570862213cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "03b6acb3-cd8e-4174-a3bb-8d46e37bb025", "value": "T15385D01DF38D12E8D227C234CBA26232E3B578550765BADB069AD6152FB39D02F7B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "fe4b1b1a-4413-4bb5-868f-3fd58db4f25e", "value": "f765367f0a88e2dcf14edcaad7ab658b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "083e1f5b-909e-4564-89ab-a513df359895", "value": "49152:2S9ZGKd9rfG8GcW2wdgVSSnfYQrGnHZpBt74jOkLy:9GMTcYGHZHdIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371514, "uuid": "b29f888b-3a5d-4b3c-84c5-f7010bb3846a", "value": 1796096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371514, "uuid": "211753b7-c6a2-4bf2-93b4-5926de80e926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "cd03d5f5-6c9e-4d9a-a21a-eb50ef15b9d4", "value": "2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822fc00d-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "c02cc20f-6b3c-4678-b2c1-b27944196bc3", "comment": "Malware payload", "value": "eb099adfc66b6aeff93cf22c22d5c3f8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "3a4b16a9-73f1-4845-b353-04c9a1dc647d", "comment": "Malware payload", "value": "2b27254fc815f9d286a531433e62f8735cf8fce15b90a73505a85c68aafe4da5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "00e2839d-5cbf-44d7-9181-345aced23754", "comment": "Malware payload", "value": "2c993f11067eacfa11fb115b6b7b2d16d47e73d3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "ae367acb-1418-4a3c-86cf-6c5c076109e5", "comment": "Malware payload", "value": "374df1383fda91f756b1f0798d94c962a91adfb6c544b5db12151c1b008e092b400faa07ce87f528ce2fb3294aa4b9d1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395625, "uuid": "e8553447-5d9e-411b-8cd2-fb16e25a9614", "value": "T18232F6CCAF9062F4F29303DD27AF2999136561CB504CD880F68C6DE06F4B68D4A86E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395625, "uuid": "f1a43e92-1a21-45ed-bb09-955b6a104710", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfMUJtl9CX:sXX+/DV7k/3/lLAiYOpzEy9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395625, "uuid": "8794a6db-2f3c-492b-b8c1-12f8ede3448f", "value": 11947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395625, "uuid": "a707b8ad-5beb-4a60-80e5-873e2f819c1d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395625, "uuid": "236d406d-314c-493a-bb0d-e635e6ab2f53", "value": "felixReport.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565e72f1-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "ea11d060-fa57-4e24-93f6-087422ac9a2b", "comment": "Malware payload (Vidar)", "value": "6d825e642f19ccf3a3ec8beabbd0b664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "99015e9e-8294-4190-b9f4-b84b2eb67ad6", "comment": "Malware payload (Vidar)", "value": "2b4345020809f679e81374554f2e887d3b8f88dcb0fcd1ea4758305049843eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "b02bf34f-574f-4c8b-8617-d9bc7d6d83de", "comment": "Malware payload (Vidar)", "value": "ca42535e9ebae5606184bf8555463e6b732ebb18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "8edaee1b-aee3-46b0-ad1f-d3cd4dd7329b", "comment": "Malware payload (Vidar)", "value": "532edffb12700a1851251444ba3c6fee861587fd5ad8f754f67954c11098a4de45638d5428b2b63d4e2cec0fbdba4a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "4bc2a550-47b5-42b0-8e95-55cf2a1bb70a", "value": "T1095219C9B1C7A1FCC46DC239D74A4AB7EA653090472A0BBF46FC94642EC352075F8A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "85db6a90-980b-4568-a201-27dfc1369676", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "48109131-e3a0-4016-ae98-d40fbf9cdc57", "value": "192:5FZEOzTh9R4hqLU6Qe5KgNTJaz9w0Kg0r8SkS3UT3Vws1D:5fRzTh9mh6RggNTJaw0gr8JS3UTlwsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369352, "uuid": "35467867-8246-47a1-b503-61cb02c47bf0", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369352, "uuid": "a153dd26-e3e8-4535-8e48-ccf16a9243f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "7743a6fb-9dee-4eec-afad-162de24e43cf", "value": "2b4345020809f679e81374554f2e887d3b8f88dcb0fcd1ea4758305049843eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae8723e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "963e9423-4bd5-47f5-928b-9cfdd04981a4", "comment": "Malware payload (Mirai)", "value": "ddd0a3625ab392a1d8b793fb2c9846c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "0e263a7e-e84b-44d1-8edf-b3bd06748bab", "comment": "Malware payload (Mirai)", "value": "2b56dda50c50ee03790c8e06509d1461e5b5e47f6dab59ec636422c55b1d58e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "99c13fae-553f-4c37-83b4-ffaeac9c89be", "comment": "Malware payload (Mirai)", "value": "8a483e7b5e811cec7642696dcba2ab1f6ec98b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "2d9bcfe3-44a7-4249-ba8a-8ab6ab5f5c14", "comment": "Malware payload (Mirai)", "value": "2a33895761e9421a5a8068271391f427b23eb235d0fa153bba0737b19b624b381ff1b61684efb2d0633edb07dd14c400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383667, "uuid": "b668ea29-a57b-4904-808c-21cdd380076d", "value": "T132345B4B77608FE1E379D67006F38BA7A6E9268612D38545D37DDE103A6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383667, "uuid": "057c1549-f3af-4704-aac8-855302d81f99", "value": "6144:G4EjaRofuihAcCM+p/nqOTF6FNs2lguXLsy7zbGiGs:G4E2CzAF1qOTissXGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383667, "uuid": "de0bae0d-7ee0-4daf-8b6e-67921b6a6141", "value": 249564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383667, "uuid": "24bb98c4-1dba-4270-9159-a96dfb34cbcf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383667, "uuid": "b737c94b-a634-4349-8cfe-511f48d405a1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc7a129-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "ebd87010-da4d-4089-95e0-2f8e6d45306e", "comment": "Malware payload", "value": "1e57f0b9ad97c32422ddd5af26a716d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "0b269b0e-9cfa-4a08-b867-902a866ef512", "comment": "Malware payload", "value": "2b70b870ff77ff50ce2b088536afd4511a51d19b5732e398864306c0f2d186a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "34f04e8d-4e40-42af-824a-26b8e4ca282a", "comment": "Malware payload", "value": "f1adf0be9d184966057c3837e745f21503d56cda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "5cf5a088-8c79-4270-a3aa-37b614503c9f", "comment": "Malware payload", "value": "075ffa1fc7701d7adf3c9513a5ae2ca34b7d311ff6cbd6aa104afa52e1aa3a7e96c4c7b547ab9eb23d0748d24447b2c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394864, "uuid": "646ab289-f2cc-4a4f-a3d2-cee9a02e946b", "value": "T153D31B03ED856FFBC05ECD70452DC24A15DA5CAA92E5A22F71F8C98C7BBD20546D78C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394864, "uuid": "69e774f0-464f-49d6-91ac-48a5df7cedec", "value": "1536:X9x+yj6YHKFks7aKaIp5snSXsLWc5wG3svp9NlL22GLc8ErS:X90CHKFLb5sSXsKI3svp9zpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394864, "uuid": "741d9c16-89a7-403b-a113-e273d96658f7", "value": 140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394864, "uuid": "820a8a31-10e1-42c7-a679-44da3bb1994f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394864, "uuid": "72f17bcd-1f07-4d95-bd39-b098045a5063", "value": "main.mips32r5el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df32072-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786373740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "ccc7dcc0-7461-49cb-9988-e679b0477b10", "comment": "Malware payload (Stealc)", "value": "df18d490851ffdad16ca4809265ec622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "123778aa-50c4-4242-9b7e-4e33ced0177f", "comment": "Malware payload (Stealc)", "value": "2bab9646ac4ee3ae95be5e9132f90c9411ffb4ba0cd4975aaf2fcd39d59825df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "83dd8542-89f0-4319-b195-365de8ada488", "comment": "Malware payload (Stealc)", "value": "0c96191926cf674baeaf8d07970f5ca465927c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "261345fc-d03e-4649-90b1-6bfd08314760", "comment": "Malware payload (Stealc)", "value": "7d6af06b1e68de832cd4243bc1984f8559fb2bb1410201ba34df1aed832260738911a6579f11b7b4877ef6758aecef8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "3a7dc0e0-2c6d-41d1-a1b0-4aa01a6b3038", "value": "T195B67C07AC9648FAC09EA33188B746867B75BC091B3227D32E50BB382FB67D05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "ee18e00f-f27e-44e2-9b09-1a08fcefe9e0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "c1603767-dc74-4251-bbfc-9f17705182be", "value": "49152:bJqqX100jFFXTr7eUamx9f6aFoU6Ysfmta1J3Z2:b31DrKAdWXmQ1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373740, "uuid": "5763d8ea-7543-4ae8-bf24-88161fdb50ec", "value": 10595840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373740, "uuid": "5259975c-1be1-404a-a4d5-b90fbd83a57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "ef0a0ddc-862e-43c0-a701-987614be94a6", "value": "2bab9646ac4ee3ae95be5e9132f90c9411ffb4ba0cd4975aaf2fcd39d59825df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae328ad-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "034720a4-1b0b-4cf0-9b1d-ec8ff28823b6", "comment": "Malware payload (Vidar)", "value": "5c89493f49267faee52664db842efe94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "92678eb9-4da3-4c6f-b669-50725a30e12f", "comment": "Malware payload (Vidar)", "value": "2bc9177a939906cf53cdb3fb8f2b7d335946d43f0000524232427d6632e87f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "a2edba98-f455-4e7f-ad3a-02f123b79dde", "comment": "Malware payload (Vidar)", "value": "1fe2af55c05801018f70f884d77f002a4756e4a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "03033ed4-e35e-4792-b0ce-2f21f755977d", "comment": "Malware payload (Vidar)", "value": "9207860f93c0ea2a63a0c0a270fca78756cc2844906743c61280b737b1630e331f427485189427447c82f976fcbed83e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "1536578e-9a34-446a-aa19-18d9c0ee39c1", "value": "T1CB422BCA765BE1ECC46AC239D6DB1566C53A340513A26FFFBB9488803F827306638D5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "e65253ec-9546-43cc-88d4-6134934944bd", "value": "db75e6c6266a5c5f87e60d9dd9f5fd3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "4a0a0e6d-8859-4270-95b0-dffad2ce7104", "value": "192:O6jzHbHH9wVXS6MQy+TlFDxCfpjp6sJ0oMqCQymn19uncDxT0X3VY:O6PH7dWMcFKNn0o+mn19AcD4lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371158, "uuid": "390a49e7-54e5-4937-b91d-006b03871ab1", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371158, "uuid": "31fa3ea1-34d7-4fc6-be8f-2de751f4d480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "1352bd49-bdcb-4731-a13f-b579aa6b691b", "value": "2bc9177a939906cf53cdb3fb8f2b7d335946d43f0000524232427d6632e87f03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7e22f8-94f3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "b211af80-a1d1-44c4-9fcd-51ae66f237c9", "comment": "Malware payload (Mirai)", "value": "8df1c98dc22e4d4ec7910d3230ae81ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "9e97863d-ee7d-4a6f-946e-4a9108e69c5e", "comment": "Malware payload (Mirai)", "value": "2c42e4c9c0f3980dcb5b5263d328ef6929ff46df4cfd738f76acfd9237adc9af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "351e1e25-2ea9-4bcb-aff8-24d6d973b96a", "comment": "Malware payload (Mirai)", "value": "aee08a16c45755537c514e539c5a6f6af22838e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "ebf660ad-7ac4-4c75-9187-e04afbaae290", "comment": "Malware payload (Mirai)", "value": "ced9c2cd74327773576f46474cef725984e8c582e1cd43193ffd60e7623ddde27bb740a2f4e20f13ada1c4d186a75ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390755, "uuid": "fef800c1-44c6-4b3e-801a-f1730e511d5e", "value": "T1D8E3184AB9519F12D5C321FAFB9E814933136FB8E3F93101ED246F64238A99B0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390755, "uuid": "1930da14-1881-426e-b34a-1bdd2763768b", "value": "3072:gif6tgBQI0SnLAXm4PaPvG0nlLmiaeoEFUrIV9ZilryuohGsKwvyLm:gY6tgBZtnLHr20lmiabEFUrIVLilBoUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390755, "uuid": "7d66e5b9-f28d-4b5f-9e8a-ee5b2d6c6a61", "value": 150332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390755, "uuid": "68b7b37a-6d9c-45f9-b507-4ba4a5fa88ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390755, "uuid": "54016630-421e-4ddd-ab0d-ffaf936db7d3", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f31df49-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "ce84e89d-9627-4ddc-ba63-1ca523b86086", "comment": "Malware payload (AgentTesla)", "value": "fe0a0f39e675b69655ff21783555167b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "664cd90d-6714-45ee-b006-3624b312d5cc", "comment": "Malware payload (AgentTesla)", "value": "2cc6c00766b50175445fd0878e922a3ae4b6cd4e7187ea985ea6b096ac086ba0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "8521fb0b-a74c-4bc8-b3d7-8c6111fbbf28", "comment": "Malware payload (AgentTesla)", "value": "c22e8fd11731a2f6da565196a49496728903e866", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "b71986f9-75f7-4caf-9429-578d3fc20090", "comment": "Malware payload (AgentTesla)", "value": "187e6047bc49d31e14f8375131068b75a646ab9429407c22845f362951bf4c1ad27feceada809e2d8c39a82a90593f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "22ba1ec4-4935-45f1-991d-619ff0a7ad79", "value": "T18935F1142317D812D1D687B7F8E0D27432A49ECFBAD2C3D65EEA6FB7386A7C11984241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "c3a0da4c-b427-402b-9734-f0be1e00e00b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "0984160c-da6e-419d-8e94-df827042fa8a", "value": "24576:Gp50ZGsucJMciKxzPmWzD3jUvwAS25ms1+oOY/gpCt:Gp0JMYxLjawY5b4oR/GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372803, "uuid": "3d058541-5edf-4784-a2ae-7c95b80d8ce1", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372803, "uuid": "e9dc2919-baba-4dd0-8201-1d3194a70e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "7aa43a98-c484-4522-bb00-6635fba02a8a", "value": "2cc6c00766b50175445fd0878e922a3ae4b6cd4e7187ea985ea6b096ac086ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39566e4-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "0e7a6b14-f565-4222-92ca-72de06d44ef5", "comment": "Malware payload (Formbook)", "value": "60d2b5a1d00be1ea037d7fc370bb6d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "aa332227-a513-4876-8bb9-cbfd418e1bda", "comment": "Malware payload (Formbook)", "value": "2cdb52e25f9467b3616c886851b604ec9c69d6038bfe2405d54c4ee474c8e694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "a0be3430-1ccf-4f10-a83f-0c00b273aaba", "comment": "Malware payload (Formbook)", "value": "8da0491898b06bd502f878071d6c13eb872b5921", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "0cbbda36-6589-471c-8710-1742702c1a86", "comment": "Malware payload (Formbook)", "value": "a4ce49fe504496838d9a9e2218a4fb4073c70f2edd0b8a1f9dedd58afd9f3e170a4259d2306be15ae328a981c08f784f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "8be5e7e8-63ac-4e91-a2a2-814e8c2457d1", "value": "T1A7252328529CD811E6D947B65CF4D33206B02E8EB03AD32ACFED3DDB79937042558BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "c96c2b1c-789d-4305-82f7-252b3a3927f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "c3851c3d-57e9-42fb-95a5-30a975e6922a", "value": "24576:0//Q4J+rFdKGYOfz8V66VtQ+iL/E8EXxX:03Q4J7Tik66bQ+ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368730, "uuid": "3ca6aacb-6a58-47bb-97c9-c24a1ca7ed82", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368730, "uuid": "2552a2bd-18f5-4d66-b36d-0fa3c0531cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "50e025c6-50f7-43a1-b072-65994c2814ea", "value": "2cdb52e25f9467b3616c886851b604ec9c69d6038bfe2405d54c4ee474c8e694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7498cea7-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "18f6a886-0b95-4639-8f85-6ac4cb96f507", "comment": "Malware payload (Mirai)", "value": "a656fa4a3422ff527611cfb22e9e1257", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "d745af4d-441b-4c48-9405-c4e1ea725594", "comment": "Malware payload (Mirai)", "value": "2cf4fb390b5e2bf9f77b4ca68425e28fa10eeea16875cb43b8011ee81ce84ed8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "0ff0ea95-e158-4c84-a8c3-c6d100db2315", "comment": "Malware payload (Mirai)", "value": "9083ee0b3b74ef216a8fa5b4fbb89fc10f340870", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "d3954e6c-a83d-4345-b34a-a93cc7595f1f", "comment": "Malware payload (Mirai)", "value": "466ad5cdaf6efaddf741bc73f8f3055b4b1c031793b7d6ea734ea458528d0c68b019cf4b37d038686527b5e565dc54b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356947, "uuid": "b9355ed8-425d-40f2-98c9-8ed60d514472", "value": "T179836C2731395607D0E1E1BB11F74B22B2D20BCE6358D28EBFA20D9F9E153506A66DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356947, "uuid": "e47c481c-b4ca-462e-8e6f-916f227c116e", "value": "1536:oSSpuNyJHa2glVXcyGDxyS6DLAR/e9OsodPSwwhsfiV0pbdUJdOoi:oStNHXMFPjS3pmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356947, "uuid": "7ec15313-2c04-4a64-a031-7fb0216cb2c0", "value": 86444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356947, "uuid": "21dce704-c894-44a7-9412-e584e1742c89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356947, "uuid": "9ac49610-49c5-4ea1-9719-c519da923c45", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd58b99-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "79439329-9da1-4fcd-bcf4-fb1652050a17", "comment": "Malware payload (Formbook)", "value": "988172bd1bca9dcfc74e9182f948a476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "8e7562a4-7881-4771-a121-e9fdc4bead31", "comment": "Malware payload (Formbook)", "value": "2d7135ac9a46920abc8c7c70c70389193835d3a3238fd61fb6316b9c47dc6278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "7884a4da-f39b-418e-9fe9-5149aa3fce7a", "comment": "Malware payload (Formbook)", "value": "9d7011cbcfa006d2e5d99ae37c3e8e81afdb48e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "fd296011-8cd8-4a19-ae15-6fe4afc450a6", "comment": "Malware payload (Formbook)", "value": "1bc3a37b97278645164150eb5379150ea14ce35148a170c4d02d0ad7ddc536f02c1f393f597159030f6871472c4df611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "8ca67264-e9be-417d-8c7a-c631f5a547f3", "value": "T1622512656256E617CA50237A4E62F3B527BEADE8A900D31BDFEDBDCB78327118C10143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "f0cca8b2-1bc1-4565-95b2-910c8d4ebb50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "fb53f570-b26a-402e-8566-cdef3e253bc1", "value": "24576:E1/6pz/J7636o0xhGIgw5YLbqja9TTtyD1J8XHwS:LF/G6GEXjITO1J83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371539, "uuid": "60050d66-8f81-4435-b140-58bac12b369b", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371539, "uuid": "09c796ca-5c6f-4f2e-9dec-5f5325c7d0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "fc656f58-fcef-4d3c-86de-d66346f6f2dc", "value": "2d7135ac9a46920abc8c7c70c70389193835d3a3238fd61fb6316b9c47dc6278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e1205d-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "8ab7b188-aaef-4e5c-bf48-e8610610ae58", "comment": "Malware payload (Formbook)", "value": "84e9ad5822c699e199e1148b7545d983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "518b23ea-9437-45a3-b21c-a2712d18ef0e", "comment": "Malware payload (Formbook)", "value": "2d74955d6968668844d6b59b1055739038fa8c26fd64b8ffba6a1b62006b10a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "352ac02c-9093-4460-beee-4b98478e96dd", "comment": "Malware payload (Formbook)", "value": "fa757c29a860ffeb04e3f835645dde6372bf691a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "493f0847-0456-4a7f-bb7e-00f0e6add4b9", "comment": "Malware payload (Formbook)", "value": "4c37d79b941ea7d269aaafdc3a2f9ee830e8ca4fa16d63c993229c5044bdf4733efcd48144b91a093022cb123b655db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "0cbf902c-d8df-47b0-9527-3356be15d8f4", "value": "T14B350248231ACD02D5939EB08E74D3F816B95E88F411E7739EF97DDBF87B2862941281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "bae20951-2591-4f94-a309-3dcbc83dd9de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "e4bb164a-5491-4d9a-b841-a3c086700e87", "value": "24576:tnjR6pFsRTTunH2yfFJbrRjJ2okn8Dftqq4S71yCiRMD31Dek/lUjy:JtimRvurFJpjJ2h8Dfoq4S5ydRMTZwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370874, "uuid": "b383a560-169b-49c2-beca-008f92db58ef", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370874, "uuid": "e02d70b0-17cd-47af-877a-fb9cb3402e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "3a1153ba-2ce0-463e-b791-92cca61eb588", "value": "2d74955d6968668844d6b59b1055739038fa8c26fd64b8ffba6a1b62006b10a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b29c897-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "05cef3a6-df42-4c6a-a0a0-c4e39b859e8e", "comment": "Malware payload (AgentTesla)", "value": "023a0b2f195f42b9bb4c08fee7bc268b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "f4dc78d1-6c5f-4adc-80ed-7778261e47e6", "comment": "Malware payload (AgentTesla)", "value": "2d82743ae026ce3c12a4e90d0d5ddc75943134e40bed325486edf5d0c7a7d68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "d48deb47-a24a-4169-a603-542953abe794", "comment": "Malware payload (AgentTesla)", "value": "6a9bcd8a2f58a744171c855c76351c589c308768", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "1c2c63a5-b3b1-4ebc-947f-2ec3e02dc007", "comment": "Malware payload (AgentTesla)", "value": "3c71ea48bf0fcca4ebe9676ace6f63a68c7c5c1451ac74e6d58dfa6cf10d7801de9a1c59496e6d6c16f2025ca82135f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "b1991e4b-c554-4bab-8655-960ce30e87fb", "value": "T1AA2512E4B2E5EB19D7B64BF10D31E0314BB46C699135D30A8EEAADCF7A64F450860B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "9e22c4ff-26b6-4de1-9ef2-0ca191883b6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "afa629ad-f2b6-4b6a-a852-17883d275a3a", "value": "24576:eaj/Og3o80QzDieLl1cvswDdhWDCnss9e7VC471qKF:LPL0QSclEHDmCA7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372366, "uuid": "2982bd31-0afd-457e-a065-31643d428bfd", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372366, "uuid": "7f69a9d6-9fcd-40ed-a6ec-c9a1076ca47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "6613a4ca-e2eb-487e-b804-42fa97ca5290", "value": "2d82743ae026ce3c12a4e90d0d5ddc75943134e40bed325486edf5d0c7a7d68d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4cadfc-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "b5ae3e00-67f2-40e7-b8f5-8ca87871d723", "comment": "Malware payload (GuLoader)", "value": "04334e4c4356edcd7e2dbb6edc5aa6a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "85f5279e-cd54-423c-b94d-1d1a3a5b676e", "comment": "Malware payload (GuLoader)", "value": "2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "c6505376-f544-4fc2-9239-dbc8ac0dd78a", "comment": "Malware payload (GuLoader)", "value": "6493dce0cd60681781e51da6eb2fbcba0847cf6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "04ce7cb0-4665-4cd2-b3d0-cc4f1efe9502", "comment": "Malware payload (GuLoader)", "value": "49bdeb23c28eccf49a98a0c8f6270c80cdc0ddbf219ece15c60c7ff77838cbf85d7d5735da1280b2e112b680f0086558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "0121a0d8-5e42-45c7-80f3-84089bdc9bc9", "value": "T1E8B4121EF780D86BEE5265723476D3DA5BF84C764A39E74B7B183F08AAB30A04E17141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "ab774770-c698-4391-8b50-3f374bfe820d", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "e4857af3-600d-4624-99f1-0d1dae4a8a9c", "value": "12288:cHadGnZ7YYQGQ+XR8+pObcwvj2w3RUw31:4adGnGN+XR10j5RUw31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373600, "uuid": "e7d27e19-2056-43a2-9fc5-91e433bb4cb1", "value": 526960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373600, "uuid": "9b1c0649-1dbd-44de-be78-ba1f0cdc9443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "9243bdf9-9c57-45cb-b5c1-3daf22b60dfc", "value": "2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1014ba48-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "184d69a8-7992-4374-8e2b-c5ef2e9b87a0", "comment": "Malware payload (Formbook)", "value": "e59847a5eebad47e446634f08339cc31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "25d953e2-8479-44b6-b666-67af44dc1867", "comment": "Malware payload (Formbook)", "value": "2dbd20c97b10c76aefdc90737cb8597ddef34f925d1ae347d2bb52f284db1632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "041bc833-cadd-463c-8a42-26ad9421bbe1", "comment": "Malware payload (Formbook)", "value": "7b751fedf7aef76d7d5ac653f39ba09bf2735d10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "65f08e5e-18b2-4212-a422-cc5af1fc2990", "comment": "Malware payload (Formbook)", "value": "b445a09e05b9cd41a13c694e83a33ab7e42a800c001c8cb521e96e6acdeb96ff07ef9f1b12d162ff04254ae3ba402a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "79bb8e39-635d-4bab-a31e-fdbe7f4c38d9", "value": "T1EA35F154125BD802E0E6CBB2A9F0D37022B44ECFB9E2C2975ED52FFB79253C59594382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "75c1387e-27fa-4081-ad06-853d9fbed757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "e5547181-d981-426d-8311-c3b0070b2b48", "value": "24576:3p50OV/+KN/hpLnQWGgfldX2I2JUoPSv2JL8wGF:3pnJ+KNppcjgtdymvmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373099, "uuid": "481047b0-8b45-49eb-bc06-9b1bb096d15d", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373099, "uuid": "cdd3d28d-857b-42ff-a848-9d784377ee27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "9301d31a-7de1-4b12-90f7-ac3e64e63e5e", "value": "2dbd20c97b10c76aefdc90737cb8597ddef34f925d1ae347d2bb52f284db1632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c92fc6-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786368388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "6a406ea2-0189-4597-af61-34c4ca3abe6f", "comment": "Malware payload (GuLoader)", "value": "9e63c418dc098c45c5a670697f73a884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "e0738832-f17e-43d1-8f1c-9ce699c29199", "comment": "Malware payload (GuLoader)", "value": "2eccfbe65c4f6fa456b7dcfec1102911bfae392dcb4d92f09356e6356fe3d5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "3f8a16a1-42d3-4b58-91d6-9a339000c6b1", "comment": "Malware payload (GuLoader)", "value": "66ac84bf011ace0788e5c101892f1ba353992d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "dc953971-13ab-4282-b44d-4128ee866b23", "comment": "Malware payload (GuLoader)", "value": "feebcec49bfe2e4d8ee49349253f711041e81c2d7f92f7bc65ff2197b660b4ef9ca120af966fd31105baaa4896f13bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "c69837d6-f76a-4311-845f-fda127023f5b", "value": "T169C4F151B746D123DC1729749522D6D2D923BC359AA0C873B2DAFB0F26378E26C7232D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "40df264d-b244-4e0b-8b2e-41e991d58c8b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "a91c61e5-eb03-45d6-ae4c-0f56bda84ab8", "value": "6144:jT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6Z/9GCj0qs5u7jSkcH6T1ROMzDz1:jTsAXF28crKGbJZ/9GC9s56lcH6Tbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368388, "uuid": "a71bbff8-f4b4-41f8-9fcf-1447f2e1ae02", "value": 553312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368388, "uuid": "a4f4134a-a311-469d-ab4b-1c0592db3088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "318c2d31-4357-4e84-8b4c-9e81436ff0e1", "value": "2eccfbe65c4f6fa456b7dcfec1102911bfae392dcb4d92f09356e6356fe3d5c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f349931-94f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "e1b20095-1b43-4717-95ba-de86c4d45424", "comment": "Malware payload (Mirai)", "value": "0e613efff8df5510180906c0cf90f710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "fa67e1fc-2b6e-4842-b624-5b412e3111b5", "comment": "Malware payload (Mirai)", "value": "2ecd02e58794bd4ee56accf98254ef1f296946d303081fbb49704deb51173c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "291acf49-2f7d-4a4a-abac-8c446b80999f", "comment": "Malware payload (Mirai)", "value": "10017989230fc58d330fbaa340e15740f483287e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "c5c2cfeb-8908-4b7d-95c4-e96327d7ce70", "comment": "Malware payload (Mirai)", "value": "7141d826cdb4f9a9d50148427b0f614889ae6a5976327109cfe1926ad141c6805fed158e80b4ad7df31c0ca4b1d20a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390305, "uuid": "0ec6c2a3-31c4-44c8-b124-316073ce9e38", "value": "T139146CA9BA0F6C41F1C6D3F9DE8C83E13E1735E3C77689B1791213ACCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390305, "uuid": "1059782f-2ab5-4d35-bcec-e61ce13b959d", "value": "3072:icxmMrJ/mn0LyElvYRCSn6yjqO37+EEuKS7FVHJGQMrr3Snoq:iTMrJ/s0LyElQQA6wqy7ySRGQrnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390305, "uuid": "8eb54089-b926-40ea-98b8-652ff6ba6e55", "value": 202736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390305, "uuid": "53a116e0-f0d6-4c26-b87a-7b41f4020b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390305, "uuid": "3a53002e-2080-4ba8-a097-a398c233c5ca", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd611777-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "ffb32731-a83f-42bc-a8fb-e6ffaa3b2b70", "comment": "Malware payload (PureLogsStealer)", "value": "5d47e6b90474ab5d30a1493381315e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "2a5c7a1e-208d-4918-88f8-31d1b22283c1", "comment": "Malware payload (PureLogsStealer)", "value": "2ee7774c3cd441c37623cac190bd3903483d9c1cef360d4b84a8c309f0543de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "ef57e791-57cc-41d2-a4fa-269edd55d103", "comment": "Malware payload (PureLogsStealer)", "value": "64310fba3957fc0c0560cea4a64666503eb9aae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "ca82cc56-268c-4453-ac37-158c105cec8d", "comment": "Malware payload (PureLogsStealer)", "value": "1772e72a71c38dc490280f304ad740a426f35dfaa02cca3c114d6c4ab638adb9b11dd8db83b4c1326aa5220c09c97307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "5db3a9ca-a601-45a1-88fc-eb674d430e6c", "value": "T111751205125BD803E4E68BB2A9F0D27032751DCFB9E3C29A5FE95FE739163C5A950382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "02bdf176-752b-4e09-bb0c-6e835176c678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "03e4a054-62f0-4bb6-965a-e90f4f419c60", "value": "24576:Mp50f7PI74k759ZP0gLnCusM7fN3VAlsiW9A33dqZTtKk4qgLUrqO2vH:Mp4I77JcaC4VAWo33d+AknHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373068, "uuid": "39ea1223-413f-44c2-a928-3f7b1cb9f6c9", "value": 1692160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373068, "uuid": "8454b79e-91da-4b2a-95de-318d2537d12f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "38ceba15-918e-4416-9beb-30173ffeb15f", "value": "2ee7774c3cd441c37623cac190bd3903483d9c1cef360d4b84a8c309f0543de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b81d3e3-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786346114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "38a3e89c-20a5-4e4d-9b6d-417d9daedaf0", "comment": "Malware payload (MassLogger)", "value": "ae6a59c87e8ea27fdaf6b428eaf48e25", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "377f1f1e-8a1b-4e5d-899c-c1d7bc37a40c", "comment": "Malware payload (MassLogger)", "value": "2ef9d50b77db88c2e8e2e17a0fc04c4ab38e5356f86bc836dd132bdf03b922b2", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "89a9ac10-6051-45cf-bb5e-8b327d1d119c", "comment": "Malware payload (MassLogger)", "value": "417ebb5693b014f5cf1f4b75f6cd752a42316b9f", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "a073d48d-77a6-481a-9021-32d625ef9003", "comment": "Malware payload (MassLogger)", "value": "b4bfd5011697c3c1a0d1b2b7b5d31c6371694f958a4729f2b29029a286093ada76a2cac04ce9cac0940ccaed3cb35a8f", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346114, "uuid": "4293804c-88cd-4610-bcba-1a9005a632d7", "value": "T1E853B1A21E28C0E32E5DB45460C19FEE867A7117BDB94D0717249BA2CFBD1CB3E855C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346114, "uuid": "dbbd76c8-ed6e-4e31-9928-a900d6a8798f", "value": "768:dMFFKvQD6GPTAFgfvcR9DFfhKtxYWHddP9w/xzl7kIQd3GfY2d5vWbYrmGY+uRM0:Y8F666GTuROg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346114, "uuid": "6a132a33-bcde-4eba-a899-c1d0d0ee46e4", "value": 60926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346114, "uuid": "397f3368-bce4-4ece-bcf1-d3345d371d1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346114, "uuid": "b44b4e79-404e-47fc-86dc-445a03d0270b", "value": "e-dekont.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c51e6e9-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "ffd7aaa3-8c6f-4341-ae7f-3f8247a5d072", "comment": "Malware payload (Formbook)", "value": "ff657ddc83226d6f028e88735959061c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "8154fd04-1d3e-4f8a-8b15-5bc049ee86dc", "comment": "Malware payload (Formbook)", "value": "2f03bad2bc7bf08deadf708941a5e1337c94c53b1dd3980b7a9d65bde4a4b404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "6e3bad9d-2634-4943-89c8-c089d7e937a1", "comment": "Malware payload (Formbook)", "value": "e97114c8180135b2f480f5e67f469c3403618c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "9cbe809a-742f-41e6-8937-183f37bb68e1", "comment": "Malware payload (Formbook)", "value": "f29d741c0656e24246572448a64fb083431630a581f34937ff9f5cd80af93681e281b663822529aedb3e8417b2b1b96c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "7ef5a0a6-8e46-4e3e-a194-a4c0382370f7", "value": "T1132523A8AA55DE13D8CA0BF60871F77FA2709E88F610D5578BEDDEC778189052C4C982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "b1e9248a-2594-4866-a5a5-4eea31f147da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "882a3ad2-b6fb-41a0-af06-7e8bc842e7c2", "value": "24576:ISoNcnWE97RlOByAFaCSQyVzHLvuPrnmgGkh:ISooWE9llOByAECSQoLGPLmgGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370758, "uuid": "d91b8aa5-cd0b-4c27-a085-0aa6dc7f574d", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370758, "uuid": "38f5c3ad-cbf2-44ac-ae3a-c65749702a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "51643c17-4324-4406-ba20-f5d6d1212eed", "value": "2f03bad2bc7bf08deadf708941a5e1337c94c53b1dd3980b7a9d65bde4a4b404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f1d0e2-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786372955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "d05bcdcc-1c35-4c63-89c7-0aa7c37e8d46", "comment": "Malware payload (DarkCloud)", "value": "1f5cfeb2b56735e2da6f69b949de6929", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "f26e6abc-95da-4110-b973-479662bc8c15", "comment": "Malware payload (DarkCloud)", "value": "2f0eb4634db7c6601bc5c6e2720d769da57e7598293f5881a58f4186c74687a3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "7875d916-2c09-4983-b366-d5e6052eece0", "comment": "Malware payload (DarkCloud)", "value": "ad2846791bc3ac3ff8ae473d052b09c7d1180ecd", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "944fb501-176e-480d-ab2d-ab0913d9cd1e", "comment": "Malware payload (DarkCloud)", "value": "c94c77949ebd6ae6bdc388f4c780d46207174c716a981ae07fe4df7de488b20e1ac9fda40b650526bf62e498c177d2fe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "3145d94d-056f-4536-a208-2c0010667771", "value": "T16A45015423268E01E1E68BF7B9B0D33537A84DCE78E2C3969FF96FE779193801904592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "ecc7d1c7-6cae-4f5b-8b47-86d4c271c881", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "8aa57488-f7f0-4e8e-887e-76d258988c9a", "value": "24576:MgigleGsWCQbGiHccJUnBv4VzrIhpOFsRgdAtVUxoLilp3+p50:sgEGVPbGZcJUn54VzropOFsudAjUmLYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372955, "uuid": "1b86f9ef-ec86-403b-b811-fc39ef5166d2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372955, "uuid": "0cb993b1-ae06-43da-8866-645930188ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "8e05d7b8-5469-4df7-917d-faa4092e577b", "value": "2f0eb4634db7c6601bc5c6e2720d769da57e7598293f5881a58f4186c74687a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9d11b1-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "2d3a81de-8fe7-4e23-93d4-04383634c8fa", "comment": "Malware payload (Vidar)", "value": "352cca020483b2e0dd9da4efbfd1f01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "b4e80e7e-02e3-4d98-9103-f7f907dbb95f", "comment": "Malware payload (Vidar)", "value": "2fff00b81878d8c45faab53a9e47b25e983e143612feb50b580c2a9e23c798de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "4b96cf86-23fe-42b4-abbe-59acb3de4fcd", "comment": "Malware payload (Vidar)", "value": "b12a32eb6d1d7738dbdb77c051436d977c8f1771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "b939ddf1-c900-43a9-be19-5fa6ae310568", "comment": "Malware payload (Vidar)", "value": "3e3a422519bb29668e16e3b02058d798f71916744bf4775cadad36aceec039a094bd1bd027283180b72cec3defc1fe66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "ab7b4783-9d8a-447f-96e5-a3a6dae59432", "value": "T1D7520A8B70D771FDC1A5433DDA8A12E7D73A30990B0E4DFF86CD86846693650B4F8661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "901b3057-c67d-4c04-a562-9c792633a3e5", "value": "25141296cd904157b75686c0bdb5f4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "bda811a1-b98c-4e90-b454-9034ce61d4d6", "value": "384:O9UxWsMFTy/ptyV0tl68vO2MPzyjlOtDKYTVzC0:GUAsGoLX6822M7yROtDKYTVzC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370468, "uuid": "5e1f233f-c2d5-4391-a191-a141750cce88", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370468, "uuid": "43b9461f-85ff-41b2-84f4-844c828af280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "4d3f2ed5-7af1-4b48-ba5b-e99c192f2c49", "value": "2fff00b81878d8c45faab53a9e47b25e983e143612feb50b580c2a9e23c798de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300e2b02-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "2cea1131-6d6d-4d33-bca6-d5716ef60547", "comment": "Malware payload (RemcosRAT)", "value": "e996dbd6325e6bd29a7c52d2d0e77334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "3409303b-e4fe-4d26-8a24-608e178568ba", "comment": "Malware payload (RemcosRAT)", "value": "303a507698ff9aab2d8df60f2ed2080e14204f3083bea4d5d01705a54cf6fea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "0c2d9c5e-c459-480f-bf6c-7995eb45f154", "comment": "Malware payload (RemcosRAT)", "value": "4759a91ab07dbc6df6e6a0c56a7ce7d521e92b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "b6fe9923-1818-4339-8636-a8251632d2a0", "comment": "Malware payload (RemcosRAT)", "value": "47c1f4027c624c767c5cd4d04ea2b08771e2966347f991fe9b4bb87e1ba1719c4ae24069d7bd4498377986d15185f537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "64d8b79d-a9e6-437c-865c-9591f0de9901", "value": "T14A55125423269E01D5D683B6BD60E33833B50ECE78E2C7929FF66FF378197812964192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "045d40bf-68df-4fa1-b5ea-9d6edf9bb454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "25e11ce6-4d72-4eee-9cbf-62c5450a0ead", "value": "24576:Jup503VJmXnjWGZEhTeG1En+iA12gm/uHSvc4shYWFM8r2I3f:0p82XqGZjsE+pyvtmlFhiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373153, "uuid": "347a4abc-9851-4370-9baa-ed350546b9a0", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373153, "uuid": "20d82343-4c5a-44be-8592-b3ad07cce7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "9573aa84-ff4f-41ca-a890-580ab018c0b1", "value": "303a507698ff9aab2d8df60f2ed2080e14204f3083bea4d5d01705a54cf6fea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2108a1e4-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "ff4038b1-26f9-4f29-a11c-9c551c60f278", "comment": "Malware payload (Mirai)", "value": "4d280660638420ae894206c80af5298d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "8842201e-46c8-473e-87d6-afc561ff89cd", "comment": "Malware payload (Mirai)", "value": "3055864bc6695a7a1b5f2fdb665bf2cc82785b5565f201fbff18d7087766b1cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "f2cb7094-f702-4607-9184-bc3e837f2a01", "comment": "Malware payload (Mirai)", "value": "b3e182f3166082e93c7175c7a91b84dcd92024c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "d1476045-32db-4006-bf50-aaabea9195d9", "comment": "Malware payload (Mirai)", "value": "9813eefb26b65cc64246e64840ac72a0cafc57aaf51bf1d2f503d58f5d2f19e0eca48acfdc36a004711dc2632eec83c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340057, "uuid": "e2e53d4c-598f-4400-964c-3c42b0f19689", "value": "T1BC743A88A2F1FACFE158EA755210BC2A5D624A3235D371C6719FFA7713B728009ED970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340057, "uuid": "ce320932-e00d-4539-b4ca-ab757b780b2e", "value": "6144:/v9OAJa7oS0NekOfzfTnr6E5yBw+fhzx5J6+LZpy+a93T:/VXJa7z0NelsBDfhzx5JrXa93T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340057, "uuid": "05422a2e-d5c6-447f-a416-3debc691c815", "value": 370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340057, "uuid": "5de70399-c687-4b31-8e68-2122952aaa2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340057, "uuid": "07d1b1f4-3eae-4350-9d36-dd32054eb131", "value": "vlxx.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0619ea75-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "d5c05fbf-567f-42b5-9ea4-2795361ba6b5", "comment": "Malware payload (Vidar)", "value": "1278b43a220a9798d8a1a73b113cc7be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "1780b827-e17c-46f8-a52d-6d01808b0ed6", "comment": "Malware payload (Vidar)", "value": "30656603bbf3ff3204c83216ceeb0efc5b64c97841e6b1dd35ac7e97b968b10a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "8d6519f7-ee4e-473e-99f4-324e6b61f52c", "comment": "Malware payload (Vidar)", "value": "f93160ab999a5a23646ac0ce8d68ba09fa9b4a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "f760b832-2783-411e-a03f-ad55b9b1c108", "comment": "Malware payload (Vidar)", "value": "8b039a7cb42d14d45b7b6e787ffb9fbee3ee098e7ddad6748d744c5cb5b776015cf0552ff038707662985484e4a9a1b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "af7d2b4c-455e-4fc5-9509-0753c11346ee", "value": "T12042EA8AF55371BCC099C3B5CA472366DAB6709013364BBF06ECD6651FC22B06AB45DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "0d1572e8-c38a-4526-b1e6-b646e1fc3ec4", "value": "f0e3160a5bd62fbc1af1bbb43e8f6a5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "8ac65d21-a7f5-45b0-9a0f-28757cd69965", "value": "192:Okx5BKxymeGq83vHyNLSM04vpionoQprn6wMU4/ENqpTFm3Vup:Okx3AkufwlvpiFi7wR0lup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369217, "uuid": "1345408f-4afb-4686-a145-5a9e0a24affa", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369217, "uuid": "309120f6-074e-43a0-aeda-b54f3ab3211b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "7465ebed-95a9-4aeb-98f3-7e1e7fc6e52b", "value": "30656603bbf3ff3204c83216ceeb0efc5b64c97841e6b1dd35ac7e97b968b10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7de17eb-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786371663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "b91d142f-1910-445d-8e74-b1b0d891139a", "comment": "Malware payload (PhantomStealer)", "value": "9b02e39caa6d20ba3d1356b5ee665aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "5b42bef4-23f0-45b8-acd3-0b4150cd22ec", "comment": "Malware payload (PhantomStealer)", "value": "30dd5e040135cdbc455db82da73669757c4efa81f29e4c639f3ee98e24de140a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "919d5aa3-8e65-4dd9-8ab1-eb6173cae80e", "comment": "Malware payload (PhantomStealer)", "value": "68b036b67728f736a439a611c336bcb6f3d1784e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "a9e2b2dc-f3cd-43b6-920d-667f3ecbfdf0", "comment": "Malware payload (PhantomStealer)", "value": "9e5d4c386b7d6baf085bc25ab621f675575aadb5f174d2aaa9d0811bf6fbee98f09007370d97dad93827c01472035521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "ef19b3f6-6931-4c2b-9538-938e2146733f", "value": "T1BD74F1282F6DD61AEE710F389DF9F731856C9EE46C628F8B671435257A30BC09C4931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "fcb658af-8d42-468a-877b-42148def2ef8", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "7a4b105f-57a9-439a-872a-d376f166a30e", "value": "6144:mT4DtYa/h305o9fgqMUuBQWYmETqukoucsUpDj5t8vfMO3x9JEGuzj:mT+Vso4DUoQFmETbrLGkAJEGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371663, "uuid": "e050f6ff-a79c-4ed8-9459-222c85208f3f", "value": 365752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371663, "uuid": "781eac6d-7da0-4da9-ad58-cf78a3186af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "c0c3b9cd-30de-4aff-b23f-00ee822407b4", "value": "30dd5e040135cdbc455db82da73669757c4efa81f29e4c639f3ee98e24de140a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d36e8ac-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786374088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "3723c915-1ebc-43eb-8d6e-d28c7ea742b5", "comment": "Malware payload (njrat)", "value": "7311320686afe0a309586adb63442d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "194da474-ddac-44aa-a4e4-8b89bd87f1cc", "comment": "Malware payload (njrat)", "value": "30f8fdb26e5ef75f382fd927a35e00ea8accd504e677058b7fd28e6a73553d40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "845ef049-5687-4390-8a63-6d592c8169b0", "comment": "Malware payload (njrat)", "value": "1dc70364adbe70b7f1396fb1ae54bd56769b1f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "0d229f65-9b3c-4381-b6b1-96a8388d845f", "comment": "Malware payload (njrat)", "value": "3a8bd6ccb26747db649cf559d6577d6a7834134064b356ac18d666dd8f3e26a571f86106e499387b3d2fbf5405b9b43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "db8354da-a5fa-4d13-aa94-8056161cf2e7", "value": "T1D80502582A16EA06D99243B80BB1E3B417BC5DDDE820E3179FE9BDEB7629F444D04343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "f52ada84-dff9-4269-bdcf-5ad94ca73b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "c01a80a9-1abe-4758-87be-3bb9de7685b2", "value": "24576:ueA9sc3qymb6fWdVLO1pGsy+Jp238NtpY3:PUs+5w6MVLO1wIp23a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374088, "uuid": "52585fdb-be10-4536-9744-c90ac1a1e310", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374088, "uuid": "e1aa7c61-4a75-4bb6-9b62-d8f0e07664a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "7159f6de-8c1f-482e-8f4e-1799dca6c5eb", "value": "30f8fdb26e5ef75f382fd927a35e00ea8accd504e677058b7fd28e6a73553d40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb0a653-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "f25d82d8-0798-43a9-b73b-357c57193650", "comment": "Malware payload (Mirai)", "value": "5c5d7f2062bbf875c11244e1b87f5af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "4557761d-a7f4-4715-9c5b-68d824e077ad", "comment": "Malware payload (Mirai)", "value": "311ac74c800cd4ce5bcc16210127e7b7a8522253f34d4d4f0f4007365fad856a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "b2fe95f9-2264-405b-8c26-2f5efb9e086b", "comment": "Malware payload (Mirai)", "value": "f236a976f97f555a65dcf791dc5be06a74097884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "63d108ef-5e7c-4be1-a242-7086fd7bb2e5", "comment": "Malware payload (Mirai)", "value": "09f8b1629d6e9a3deedd6378e25c388171edd9b4c802817319eeb49272669bc939f3479fdbe22736b0ab6b3f0ded224e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347195, "uuid": "399afeef-53ab-4766-ad4e-31a9d2ff9e0e", "value": "T17A057C6377318F64D364D2B006F387269A9515A207F261C6937CC220BA61B6D6C6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347195, "uuid": "7c1d463a-09b5-4b09-8222-e02990c985ca", "value": "24576:Lyn4WhdWS1twR4SBFFgsrO168dZtZY9n8X0cW+e:Lyn4WkxBFesrObXZY9n8Xze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347195, "uuid": "51597670-4af0-4ace-beed-809ea91813c8", "value": 821480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347195, "uuid": "7cf77a1f-d7f5-400c-a23f-41c313afcc46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347195, "uuid": "7fcca323-13e4-4119-9b94-0c351508ec25", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369ed2d0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "4f52fd29-6718-4d25-8d33-6d4c254098fe", "comment": "Malware payload (Vidar)", "value": "46c4cb407a2144f74975ed0437e48a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "541b67a2-0138-4be1-b61d-7af3a13635df", "comment": "Malware payload (Vidar)", "value": "313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "580ed542-8d8e-4a55-b57e-e702ee6ab7d5", "comment": "Malware payload (Vidar)", "value": "a3353b67c5a12271386d0c8e9adede64cfae1cb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "37a7a126-09af-4ea2-9577-cbde9b5e5b63", "comment": "Malware payload (Vidar)", "value": "0253829fc4752c03a2edfe70b760ee61d93e07775bc0de6ca8167deb6317aa583ea1f5c3f8c407d1fea839984262cc59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "a76e3aad-84f1-48c1-86ed-8aeb9a2a437a", "value": "T157422947B192E0B8C079937CCADB29B6C31730CA232E5BBF0BECD95867C255129B8714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "cc93010c-c82b-410d-b9c1-1daa67937953", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "1b835343-ef72-4c7d-bc1e-da5e66f49a5c", "value": "192:OEzH9Enoh2kGefGuAl5Kirmabt0A/+pmykGQMDxWNIZVSBpEEhfOY3VjY:OE79Bh2kGefGzvK6bt0ATZM9WkEzlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371876, "uuid": "cd060eb5-10bc-48ba-aafa-1c9a25adc498", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371876, "uuid": "a0bfeb09-8c0d-4b3a-8116-b51fde48f604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "985aba5c-abce-4beb-88c6-e88c125c270e", "value": "313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ccea93-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "97489fc3-3a25-4536-aae2-811d91cc4f60", "comment": "Malware payload (Vidar)", "value": "df5fe0a1f8cefc01363cc50171e1cb4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "184b9c2c-b619-49f3-9df5-d7bdc5fe6c54", "comment": "Malware payload (Vidar)", "value": "315c6d6b695651e4655e04dce2c13e8f26ddb1355a6c5464767f61472d5e5193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "2d9e5668-bda7-4acd-9b55-084125a63e74", "comment": "Malware payload (Vidar)", "value": "46b085268d264496e6f917df1fc09824c751682e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "f1031b9a-b0f4-4324-be41-5960ff7df577", "comment": "Malware payload (Vidar)", "value": "227170d825f1d4da4172226803b906e492f0a909b22cd98b8602fa6e4c8b41362f68ae1490309d2d25bb82d56daa335a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "72987199-05cf-4f5a-ad49-2d0cdfb43fd6", "value": "T1E04209C676D2F1BCD16A8338DB99267E46263085230D5FBF96DCC44437C356264F8B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "86068047-e7f1-40ad-84c8-eaf92f53add9", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "c8d0886a-f5c8-4516-ab74-93488215ba61", "value": "192:OgNoxW7Jlfl1h48e+UMYMJ5f5+RALIq3cmddF3VZqauEyZPew2SiW:OgNoxuNl1+feJJ50qtDFlEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368683, "uuid": "72a28c42-31d5-4581-bb2e-b198184cc740", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368683, "uuid": "d59fa439-3df7-444b-8432-82bbf4823382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "a1623b43-8a77-4840-93a9-33d2156881c6", "value": "315c6d6b695651e4655e04dce2c13e8f26ddb1355a6c5464767f61472d5e5193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478eec52-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786368468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "b3026a50-4d51-4844-bafa-dff2a7c82da4", "comment": "Malware payload (AgentTesla)", "value": "391d10ec407fff9c5d772d47e933b676", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "cdb13803-13b1-4ce8-acfc-854ceb965301", "comment": "Malware payload (AgentTesla)", "value": "3165d5a8e90f522dd5d0cef3c1f00f21c0472928658626cd29680d424281a62b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "7cbfd514-9618-41e2-945d-264c76c2761b", "comment": "Malware payload (AgentTesla)", "value": "d02a83d9016b625481aee8e5dae1bff431761a3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "65f58df4-913a-40f4-81f9-894f41ff1c72", "comment": "Malware payload (AgentTesla)", "value": "7e3e900747420ae0883a76635661fe041eb407a64b1284accd2f9295f095c35d37638bbc1d22791813c463dbf8136f59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "6bb92a18-61fa-41ec-add1-4369ed6d00c7", "value": "T1103502C03B39B719DE641735E939EDB442F91DA8B110B9E25ADD7B8BB66D200AD0CF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "79e7628c-133c-474c-bb90-d2644ef440c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "e2fba20c-22cb-4ad4-8218-0867b6b0c28c", "value": "24576:M1BejbsJ9JjVRYi+l286alB5uF8NpvSWSEFM1:MVJHbx+l2SPuipaKFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368468, "uuid": "023baf5e-c426-4f79-816d-4f568eacdb96", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368468, "uuid": "09d575b8-95b8-41e0-a9f0-08b9ee7d451b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "27d71659-cca7-4069-96f6-73cc6f35df1c", "value": "3165d5a8e90f522dd5d0cef3c1f00f21c0472928658626cd29680d424281a62b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e4084c-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786368552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "185a6999-ad8f-4979-a665-c7121f61be67", "comment": "Malware payload (AgentTesla)", "value": "432ea3f66f1383932f5d045b83c86fb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "74d8e236-1817-4e53-bc7d-6b95ce3b4059", "comment": "Malware payload (AgentTesla)", "value": "31857ab31779658b85e71641c6989c81b8fc65426ba18f527c4078de6e863d0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "66e31868-d00b-4529-95b5-a60da53da387", "comment": "Malware payload (AgentTesla)", "value": "2fcec803e8a59b7843b3b8a9b886fb47865df4d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "4cecf60e-2a5d-4409-9f8b-b433d1274886", "comment": "Malware payload (AgentTesla)", "value": "81c0a80f2aab2e3e7c959da0f3ecf52bab5d22fbbc6e48a777a6e086cd3dedd0a3466553f2691c554e62c7fec6227545", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "5bd9d7a1-831e-4678-9fd2-06a8e2f6a96c", "value": "T1BA25F1C03B29B709DC686B348535ED7553A92D68B020F9E26EDE3B9778AD3015E0CF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "a592809f-fe70-448c-bfe8-cd3cde1ce391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "231562fb-65d3-40ae-9f84-47fcf760c8e1", "value": "24576:1qGdMdXf3ftQv+GzXpOvNSE1awH/QdXBFNnn26Xbj8e:1hdcHADXsNSiHSvNnVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368552, "uuid": "4c222a13-4865-4d45-9f59-cf61bf106745", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368552, "uuid": "eaeafc24-bab0-4cd3-a3d6-1ae4d1a77414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "c5152fb3-6de3-4dbc-a7f7-e41d2705c28b", "value": "31857ab31779658b85e71641c6989c81b8fc65426ba18f527c4078de6e863d0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b40271-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "456b54b5-bc97-4dff-a7af-c89a44f2f232", "comment": "Malware payload", "value": "4fb53e314be4146f665a636ce7889664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "41e3b363-6736-4441-9aba-359aa1c4258c", "comment": "Malware payload", "value": "31ab86366c8c2c2533c7af01b151effd7399d730b1b7911e58eb8e371911dcf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "0f4d93db-7181-4645-8638-bfea80e104b6", "comment": "Malware payload", "value": "a3199ef0989f563d2a52a5877bbf17c1b66bd22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "5ed4182a-7d06-474b-8a51-6bd7517fe105", "comment": "Malware payload", "value": "c9b54a992a517343b0d1d1912c3cdc1a4b593a02a5fa2bce6c1ca8aac3df4a3854cb8f1be68949d13ea7e3ff493a3c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "427cfa1c-152f-46e7-afdb-3069b4d01932", "value": "T10DD41210EB82D8D9D1768574D6F5D6F66630BCDCD920632B5B08BFBABC39A44CE39204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "69fa4135-473d-4cdf-9fdc-804d810d1459", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "230a9d5a-df12-4d17-a5f8-4bda97d5c80b", "value": "12288:wtg++Nmxxy6Bhfll71ZEZBhA3+vRcndQmQZC7qJj:wMNmnBhflB1qZA30ydQm0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371690, "uuid": "121785c7-b533-4a4f-98fc-0f9a0dc596ee", "value": 644688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371690, "uuid": "d4e63e8d-b50c-465b-8a68-a2163169dc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "a38d185b-2d0b-4c34-8160-6f7dfda56483", "value": "31ab86366c8c2c2533c7af01b151effd7399d730b1b7911e58eb8e371911dcf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d3b2b7-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "a2f68712-2c02-47b1-b882-5077f8c8012b", "comment": "Malware payload (AgentTesla)", "value": "63dadf8edcaf0f8ca3db10e27e062804", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "abb195cb-10c1-4147-802a-e494ad5856e6", "comment": "Malware payload (AgentTesla)", "value": "31ea3201b32324df05845cd92467364f4ae49e021368bc810b0e8bffd0543e61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "82ff1a91-a034-48b1-9691-25fea833c491", "comment": "Malware payload (AgentTesla)", "value": "e974e1c388bc9e38c5c45f79d343d49ab12b9072", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "9e4dd38f-d819-40f6-b73e-530bdcbb4004", "comment": "Malware payload (AgentTesla)", "value": "5f81fab3f58af8d7734f7acd123f7beb272392ca0114787d27114d873b50e255dff36b659880c53a9611a91b3e58309d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "87b057d9-d024-4a94-b04b-d544698860bf", "value": "T18D4512247254F216CA852B781AB0F37A13F52DDEA012D7125FECBDEFB926B010D19693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "07dfd696-a2ef-43a6-b688-6b4c6ca13d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "07c3167c-b810-4459-aa48-a3811e4411ce", "value": "24576:WV/+lUZTCoCxm607txZbuWmBwWZxdmuGHL6S:RGZTCnmJBxZElZxo5L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371371, "uuid": "cde72603-9952-469e-95dc-35e4a1d5c0ca", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371371, "uuid": "7614bdb3-7a11-4d49-b671-a1c87dfe24e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "e93ebbf6-4817-4b53-89a9-4369d7907f02", "value": "31ea3201b32324df05845cd92467364f4ae49e021368bc810b0e8bffd0543e61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a24dbe1-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "8406d59a-37f4-4757-a3d6-99eeb55a154f", "comment": "Malware payload (PhantomStealer)", "value": "1885399e7d845a538fe8e915ce0b1efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "4335bbf7-cbeb-4470-a952-72c691cb7be2", "comment": "Malware payload (PhantomStealer)", "value": "31f433267321f551c97ffe2d78bd29f6551adeec6b9af6a1b95bee0f52a9b7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "4b22569d-e38b-4f68-a6fc-8c59b12b4a01", "comment": "Malware payload (PhantomStealer)", "value": "73369dc8f55ad3bdf01bfbc94dc897b4bb312dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "9b82d52a-508f-4287-8245-fc68207d5922", "comment": "Malware payload (PhantomStealer)", "value": "06f3c40528d484176c9e54ceb4c455b916ff9a37dc2feaf98c957f842eceb77adb12e470b09d542fc932d4525db790a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "4565d5a4-2415-4624-9697-ae334ec03874", "value": "T16945122816678807C4E27EB99EB0F0F497789DD4F239922A4FE50C6FF56B1427D80326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "874dd105-e8eb-4e61-a40a-e7171296712a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "0741e757-6526-4aed-b549-13f38aae4196", "value": "24576:sOZWFeSkGu8X+ctDEn19AtOYGf3IqMdM:sOZWAL0onvArGvIqM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373707, "uuid": "6b1bca66-28b5-4053-9e2f-cd5df8fb4ff1", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373707, "uuid": "fbca8b50-6ec7-4f40-96c4-5de0938763ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "65655cf7-ec81-4131-a441-98eed370f8cb", "value": "31f433267321f551c97ffe2d78bd29f6551adeec6b9af6a1b95bee0f52a9b7c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c175e163-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "0c04475d-24e9-4922-8647-3f1e1aa455d9", "comment": "Malware payload (Formbook)", "value": "1de299113d4df40184dd83fb177a837a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "f20d2534-fe9d-46c0-bc15-34ae788a6aa7", "comment": "Malware payload (Formbook)", "value": "324b1ae63d608956def08a3041d854ccd16d1905f5d5bbfb0385a9106f63025d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "deb539c1-e91e-4a06-8368-ec201976ebaa", "comment": "Malware payload (Formbook)", "value": "e49aba3b54bdf3cec1f55dc3d0f47131ef448b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "737e859b-08df-4c73-87d0-9e1cead83276", "comment": "Malware payload (Formbook)", "value": "724460674d3b789729cacc9cdfededaf2a8d65d3ec3888ac643cbfd1d381d066ce746a86d7f34cc04bdd6d92ed850c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "eca17afa-9261-4b1d-b807-9ecc8c175855", "value": "T1673512645E4EC412C0D21B7409A0F33842B56E9AED31CA175EDDFCE779F7A09AC187A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "00cdb6ef-d3e8-4e99-975d-84ec417af51a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "6a21f3b1-3b29-49b0-96ec-ae0d18f9f21b", "value": "24576:4Nj/0gD3de4Szrp4iUfeOROxO5TU7aIQu2rg4EdgEc3oA+vCxTPOZMCWFJ:4Nj/0gD3de4Erp6JYxO5k4u2M4Dh+vCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370391, "uuid": "057b0112-9605-40c9-a5ef-0860cce8a6dd", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370391, "uuid": "9186d057-9788-4a07-a3cd-abd7cbc3f90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "aed30468-8129-4e47-87db-d6c80f6894a6", "value": "324b1ae63d608956def08a3041d854ccd16d1905f5d5bbfb0385a9106f63025d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4944294-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "4c1cd3ac-53b0-4dea-8909-cefca4fd1a44", "comment": "Malware payload", "value": "29980d25febeb00552fbe51ecaab22d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "0091978d-18e8-478a-9053-ebdefc841ca6", "comment": "Malware payload", "value": "325f72a5df88f10ec123667268740c0b32a554db2cac9dbfdc0ddcb16a6edd43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "f593fc41-439f-4006-a0b9-8728bf9a7295", "comment": "Malware payload", "value": "48b0181f0a938da1e69e6add47e7cc1204e55816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "5f7ccff2-8814-4ba3-9860-a159144bd7a0", "comment": "Malware payload", "value": "c661ca5b91a4e3a8da7443c7d24159106fbf7e644dfde624ce39dc2238b40f6736610c63ca2249ab13e216033c612d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "c98ef68c-4fd7-4275-9df5-c0376b8f3e51", "value": "T14465F6C733A401BFEAA6DD7686128507F6F17F0D0262861EC6607F75EE3E6E1162E211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "4c63dbfb-d407-4595-a6c3-1422ca2a0e7a", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "c9c4492f-1793-425e-a55a-3d0bac7e3d2d", "value": "24576:MCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNreO:/1H4jR2TYrQbDTre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368221, "uuid": "7456bb6f-55df-43b5-87d9-cb0a56093c97", "value": 1416704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368221, "uuid": "6bedb289-1f99-4b49-bfb5-48133fb17aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "773de72a-3663-42a6-a14c-9fd4648eb2ce", "value": "325f72a5df88f10ec123667268740c0b32a554db2cac9dbfdc0ddcb16a6edd43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5e4893-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786371452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "72a1d7c2-7c20-47c4-8cd4-9b03342f7f06", "comment": "Malware payload (PhantomStealer)", "value": "319f72540b445f8326b92a0b5c99ed35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "31f8edc0-d97b-4c0b-aae8-937354e1577f", "comment": "Malware payload (PhantomStealer)", "value": "3282a697cd30a544c0d3fe24d748676c28da50350c2bfbe4738826e3d9f68b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "d1306421-6e86-47a8-9ba2-e88ab8f107ee", "comment": "Malware payload (PhantomStealer)", "value": "d62dec2255f51e841dc5855f2ef547518ab3aa80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "f9ef326b-732d-499c-80f5-923aa61570d0", "comment": "Malware payload (PhantomStealer)", "value": "98072d07b9f328c7ac1d66f15785c14b06b82f7cebd6e8864e813a7ec9a2f557865adeefecdcbbb6f2a086a4c7a016e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "30353134-96af-496c-bff8-2d38af5278a7", "value": "T10EB4222DB75E8B7BC0B99B7C94FB365719703B8204B1BAFD589463B61B13A310750D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "de9b8181-6eb6-4273-932f-667bf422e2ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "851a7eee-583b-4315-bf9e-aafab645bbc0", "value": "12288:kMvebqob2mEajSTSMlrrs8MbUwJnH+QivO6zOkVc4:s24qZvs7NeB2oV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371452, "uuid": "2e681907-9132-42e1-aa02-32af4e34754f", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371452, "uuid": "768b510e-048a-40c7-9b4a-dbb96f20be5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "cf44d7cc-366a-40bc-8887-ca2249f7ad36", "value": "3282a697cd30a544c0d3fe24d748676c28da50350c2bfbe4738826e3d9f68b6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62ada9b-94e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786383256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "ce0e21b7-3f2e-49bd-a938-02cfe90e033e", "comment": "Malware payload (RemusStealer)", "value": "aed45aae8615c1da1abe40c18ea0dfd7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "3cfaa378-252d-4df1-9551-6852e112efa2", "comment": "Malware payload (RemusStealer)", "value": "32c100b984e2a26d588fafc648dcdd7694788d0c18af15704e3601ffc001f334", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "fa89e6b3-ec46-44fe-b05f-0a8e6573222b", "comment": "Malware payload (RemusStealer)", "value": "7ee91df07c1922d3b9a8c0154d4ae603bcb0dd85", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "073c0734-4445-458b-984d-54afa48d45d7", "comment": "Malware payload (RemusStealer)", "value": "3d1b0b55c6b997a53b6f048d4e373a5bcfe4b2a8835792be7b5b62605da57c786e64305fbc6fa771b1c89c90c16d9a60", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "d61da67e-d98d-4350-ae07-58177a7574c1", "value": "T130D523DABAC66E54C474C3B4524374BF327F37888C619E473ACCAE406EB6518643B762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "c53c76d2-3358-4e4a-867c-ce60a135d565", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "2cd9823f-d6d5-4fd1-adef-fd1ce9ea87f3", "value": "49152:e08PsrWdChqpuO3yIEL9CnYjD48khLVkhaGrb7n9iojzJVPNc45TTSIYbmUDZ:e0viKOCIERi4D8hL6Vb7n8OXG45TWjbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383256, "uuid": "aed27125-62d8-455c-b7d3-fd2267ea706e", "value": 2918568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383256, "uuid": "3fe9367e-a52b-45f2-8d0d-911e11779fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "3bdbea4b-ea30-4aec-98e7-34d7b0055b88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9d9b06-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "8fcd60ce-52b6-441a-b041-2778d00fd5e3", "comment": "Malware payload", "value": "91b615758dd13c8b12d7f075d66405b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "6e227330-e179-4d8f-9413-36256f02e226", "comment": "Malware payload", "value": "32c3d8d011591ce7d7bcb96a2227d5e7d70f623299100d8421c889f65219ed08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "7f611b22-db78-4f56-9e52-2d87aad78880", "comment": "Malware payload", "value": "ef38a74374bd6012d3260327da2029ef60f7e409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "11e50bde-3483-45f5-9e13-551a035f46d7", "comment": "Malware payload", "value": "990ee6cb162e962569f1dd4036c0adf47b8cac763c2e52b32a1f934c52b9568f5cb5b9c1bc58dcf976561150828cf9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "01232a6b-7520-4bae-aed7-4fa5dd27e49d", "value": "T113B6023FB28B653EE06E5A3A7972A110583B7A6165134C1697F4C88CCF250B11E3FB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "47f3f632-6bd8-4adf-a670-b7b58a34e516", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "a91a8af9-d982-404b-85b6-dde9323afaa2", "value": "98304:c5OV+kz1ktl80FgIU8rzyvry5y/LUV4v:4EWtKf8aTky/LUV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373359, "uuid": "af36cf91-08c6-4fa0-b50b-ea9e3ab3b7b7", "value": 11222098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373359, "uuid": "1bc49126-493c-485d-a23e-05d451231943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "2939f6b5-88b6-41b3-b91b-182b687ccf65", "value": "32c3d8d011591ce7d7bcb96a2227d5e7d70f623299100d8421c889f65219ed08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eda8f62-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786330148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "a7dc2265-bacb-4f60-a3d3-b5446265324d", "comment": "Malware payload (PureLogsStealer)", "value": "42080c1c904c9da1c3a56db89dc44d62", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "2943ddc9-193a-4512-b2f5-c3bc6e7a8f03", "comment": "Malware payload (PureLogsStealer)", "value": "32ead15908ca61088701ec6ee4c692658585746bafb52cce23c047d035fc91a5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "62aba100-531f-4411-9905-cc0f8ed6865e", "comment": "Malware payload (PureLogsStealer)", "value": "78625ada2c1150ba449da78370521663c1785f8d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "290f0ce3-7eeb-4865-85cc-0c2f9876bf04", "comment": "Malware payload (PureLogsStealer)", "value": "183af939ec72df0f21d3c030e4ce58c6117ad17ead77f74302ef182658c9ddc9e8c1511a95f8c932a7bca32ef938b746", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330148, "uuid": "9e04fba9-994a-4966-8727-3cf4eee3c8bc", "value": "T1BE13F8E6504970491AF3C1A138D0E0D2B8CBE9136F9F5FDA766C94900BF13E476EA9D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330148, "uuid": "8afaa049-cc9e-4a57-bd03-f427e391d507", "value": "768:prUMuOSDrUMuOSBrRrUMuOSDrUMuOSBrfr/:AjGjqjGjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330148, "uuid": "1e8dca8e-4fa7-494a-b286-d1622e34b682", "value": 42030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330148, "uuid": "4c95c88b-1921-4029-8db3-aff13bbf079d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330148, "uuid": "3406018a-51ed-42b6-8529-0b760b432aec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70f15c4-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "84c974ca-2da1-4d4b-aeaa-91794690bc91", "comment": "Malware payload (Vidar)", "value": "b41aa9edb7699465a194bf3bb9d73f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "3fbb9098-b381-4e29-a511-967a21ad7988", "comment": "Malware payload (Vidar)", "value": "33a6dda775655ebf2bfe25ce820df5829abb4ddf55955fd98d50b3b2d2db6789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "08b31539-ce96-4833-b0f2-228c4386d4c4", "comment": "Malware payload (Vidar)", "value": "cef88f5aef2116a28fdcba85c47c0244febd542c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "96e46ddb-2d9f-4fa9-8d26-c4e5381ca748", "comment": "Malware payload (Vidar)", "value": "5a4dc88ba58b8aac4de94b84e5eec5102fc53a0ad4adb3043ac059b1e24cf88d2f429522eb3a5cfba1b2b0cde38b2b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "8a8a7b5f-a136-439c-9cde-a4f53cd965e3", "value": "T11142F882B582D1E8C0A7C370D69621EB9572340007326FBF679843956F9273577BDB8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "791851eb-2f0e-4451-bc54-1df190cd9193", "value": "66ebb7345b7f4b21730e0a314cb2039c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "7c4649cc-2d8f-4c2b-a185-601c1918197a", "value": "192:O/E5DasL/+FhOno0BqdhS2R3oBRrhEShQVfbfCWnRcuc+3VdkVCwlcqM:O+HL/U0BqdY4oBfGRflpc+ldkVCwlcqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370829, "uuid": "a5b80a96-e552-48c7-8c9a-058d07443164", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370829, "uuid": "d5ab2fc0-d969-46ad-8754-2cdca03826fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "b6351a9d-da02-4154-beee-f9faef369b81", "value": "33a6dda775655ebf2bfe25ce820df5829abb4ddf55955fd98d50b3b2d2db6789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9332477c-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "e076ab96-7f3b-4217-933c-36c52b86055a", "comment": "Malware payload (AgentTesla)", "value": "9a765f1c66677f75071b26ae2487b1d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "387db0b3-a6a0-48d6-a636-8bfc46f238be", "comment": "Malware payload (AgentTesla)", "value": "33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "5af6e015-fb93-4d30-ad61-24694e35619b", "comment": "Malware payload (AgentTesla)", "value": "2084f98c0a2055684b7db1063006057117e4840f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "bc540c7b-24b5-4c4e-9d4a-1d521c05c09a", "comment": "Malware payload (AgentTesla)", "value": "91a8bbcfa7a31266314a3b718185ada871c730b2136941d4550140fd1d73283969443375fa88f4719e1055e508c34b95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "30313fee-5b39-40ed-9ffa-301eaa7284fa", "value": "T1527402A37351E443C5600774597B8F20F7E5EC686A87275B2B80BFAD7DB32C1AE0A251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "ff08d1f4-5c78-46de-94e1-c78a4cb34527", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "2f1cedd5-8930-43ae-986a-ad34d6fe04a9", "value": "6144:KxFS7C/noG9vC2+J3xSfHcjrZBXe2xkESEglIQ3yBwKIeeJP:MeAnoGhC2+V4fHcjNJfkESN3yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373319, "uuid": "02f3f8e3-8e27-4034-b3ea-464828fcfa0d", "value": 351552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373319, "uuid": "a0d719e4-3a3a-431f-a1cd-e66a50c51083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "c00ea1a1-57d7-4ce6-a14d-af057068d28c", "value": "33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396de185-94ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "05329ca2-8376-4bbc-9973-3273db6bc3e7", "comment": "Malware payload", "value": "68872e78100d262e7b1c7a215af98607", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "99a87096-89a8-42e0-933a-3d62224f2d3c", "comment": "Malware payload", "value": "3424ce7c4060bc34552aee23b9729cf8e7667bacdebf6a793cf74771a4e25099", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "3361d2ce-7438-4e87-a7f4-ffe5641d3f57", "comment": "Malware payload", "value": "f9b58acbc78c3790a7a5a40a25639f0ddb70e833", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "9233eb57-0130-40e1-b007-1c9106b67aa8", "comment": "Malware payload", "value": "b2efd5024908c37edb637bd59ffb1d8a4af579ee9b1195ae92077d10e2771837e0d86aff55eec562b60a2c3c40693023", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395932, "uuid": "181a6923-107b-4990-b201-546fed775d0a", "value": "T194D097A32023567180228E60E0DEBC0077204B3E9CC0EB6D313760B02F45608F8E03A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395932, "uuid": "e7c5adf4-4aba-4c7c-ab7b-09fb568f544e", "value": "6:hTfcryvOWNiF0OAulNXYq4HvXDG+NjVsNXYrkJ:Vfcr280OPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395932, "uuid": "83942db7-443b-4f05-8ddd-d2dddbe00bfc", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395932, "uuid": "ce5719cc-5066-4478-9c88-a16b33f44b69", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395932, "uuid": "23f6be91-ee19-42ff-9d55-7c9c29c3d27c", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6d0d14-94d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786379809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "b38f08f8-8c7a-4911-a7de-8db768c527fb", "comment": "Malware payload", "value": "be7ea79554fe27f6943f411c54c97467", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "da2882e9-1255-46ca-a9a9-a2c9691946e4", "comment": "Malware payload", "value": "3505a8bd68b86e233d4e873bee78249de7b37843fbb393b883dff11ffcbe147f", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "9ceba40d-0be3-4fc2-8669-b479c9d5710c", "comment": "Malware payload", "value": "a988474dc083e6314c384a1d3eca4854e214cb5f", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "3b1b9dad-e478-4cf5-8156-af317f74daf2", "comment": "Malware payload", "value": "b8c4356ebec32e56d469eb2679d98f378b2bf69a3032b404336adfadfb0470fc018b793fc6c4b936c3768ab0a01969c2", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "9fc68331-0bbd-4738-acce-d75f4fc47d9f", "value": "T1500633E5761B2521FCB783B1D273B54F67A2F38C268C9F412216A2D0D1B2BD09DC65B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "a2c1a1e2-1523-482c-b585-8a188cfbbab6", "value": "081b147442ec931223b8226f8071e65a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "56e75c7a-6cda-4ceb-bc2a-de1ba6cd16ee", "value": "49152:YLnb1RDohUv4+Ovo8aVMtDXC6K6jLFxsfykSpflmj5rrznHfflQpJk09ANgrNVJN:ynjDmoBVMtTgmH45zHXWJR9ANgrNnJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786379809, "uuid": "3a2b38a3-5b32-4ae3-946a-a5bd6ea874a6", "value": 3704320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786379809, "uuid": "d960c8ae-50cc-44e0-abe3-b6314584a388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "42990b34-f09a-4065-9561-f45738cf12fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f474dc-94e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786384249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "7398565e-4f90-4f91-b033-106a1ed766f5", "comment": "Malware payload (SalatStealer)", "value": "e4f179223eb1625f8f41825a05a0950b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "f079b4e1-b2e3-4232-b519-633eaf14e8f8", "comment": "Malware payload (SalatStealer)", "value": "35889a75f0d7c9f13f2b1d41507fab3f29244bb06aa22582847c52d04c6ceb21", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "c1724cd6-95df-4b5d-8763-2720250f1a2a", "comment": "Malware payload (SalatStealer)", "value": "61cdc06b4f2133548b0458ca07b5e249904a851e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "bdd6620f-9056-4111-bf54-92912c0856b9", "comment": "Malware payload (SalatStealer)", "value": "0ec8a19878e1b2be3b7f755e61371bb8cc1242b365c9a01b6a3d8e09c13c0e64b26207da1a323ce3a7eb462c6a91d6ef", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "b2aac04e-9b28-4575-bc2d-ecedad019970", "value": "T11176B0B876047DE6A67F577BDA96ACDC13B516239A8BA8CD8064B7C30563331FE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "f417e58c-dc7a-438b-9e61-650f08c2a4a6", "value": "d2921ee0468211e522a7bd2607503c56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "050737d7-d150-46e9-b26d-c4acb5614ad3", "value": "24576:Pa/8b01CY+9HJx4+wZyrG7OVgcZWmOoozq7JcOH8y9nM3ULSwhTMcNjrFRWIEACP:s1CzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384249, "uuid": "64b7616f-4f29-4e88-ad45-20d6e3653552", "value": 7617536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384249, "uuid": "100ec810-bb06-4c35-9ad1-8592c59d46ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "d7df631b-8278-4635-846f-6dd44b45a119", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4a6287-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "cb9bd089-db0f-42a6-a91c-b90d4a39e31b", "comment": "Malware payload (Formbook)", "value": "1e4917c2eca73663d2d3b70c50852da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "4975a4d5-d0fe-4744-a5d0-6c4e8079ca46", "comment": "Malware payload (Formbook)", "value": "358b96d1ae69bb09fdc02dde646114157564d587f3c09137b49b2b459c791b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "08e76488-883f-485a-85c2-411f64cdfa38", "comment": "Malware payload (Formbook)", "value": "7c6c6f57e290efd7ad95b0ffed2b8fe52a712562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "e485414a-e068-438b-b800-5246932a2e12", "comment": "Malware payload (Formbook)", "value": "9a9fa9d70d20ff049e5a7cdeb32ec2f1a51bcf29e0414239e2540ec816331b32f7096b38c5987b3fcc2ead905cc2c35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "c5e71ec6-0244-4857-8171-34a9781492e8", "value": "T14655F12B6E16B93AC37507BF0820E0744BA85D5A95D4E20379DEFEEFBD39E021548243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "52fe334a-e080-4c4d-8815-3b934d2bafad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "c999ad43-4bf4-4dd4-8fcc-bf1afad85f7e", "value": "24576:Hj/Og372BiNN7WA6RffUQA5xu2t3u7eWNggmelhhKGe:DPLIiCA6JVA5g2t3t+lhob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372289, "uuid": "47f7fe81-2856-4caa-9349-075f6f934b48", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372289, "uuid": "13e8f585-392c-4a1e-bf7b-af1734af9d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "c1d59f0e-ae34-4811-afd0-0a88eab01e4e", "value": "358b96d1ae69bb09fdc02dde646114157564d587f3c09137b49b2b459c791b55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3f719a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "318a40b5-c63d-4e8f-ba9c-8b031e1fe38a", "comment": "Malware payload (Vidar)", "value": "fa19567b9ddb0c325f9476d47587cc6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "9cc4000d-1eb8-47d2-89e4-c45546ff7401", "comment": "Malware payload (Vidar)", "value": "35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "b0301cf2-96a6-4af4-901a-712cd297088d", "comment": "Malware payload (Vidar)", "value": "9e4ccb402336e984f255492a433e7bc279620afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "5f4d2082-3e7e-49e9-b46f-b8867fe7f030", "comment": "Malware payload (Vidar)", "value": "77b5a877d7fce4371c6c7761d5567ff1974f67de473a2da58d45dd0a7d6fed08c368a90cbe5d2c247b9260067144e8ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "7d358a94-fc83-4534-8c79-12a3bd4327fc", "value": "T1FF42F9C7B1EAB0BDD2B4C278DE5B0777D3663085032B5EFB51D8C4A826839916174B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "010bc70c-ef89-4a7d-90cc-53182f6881d3", "value": "309ffb298c8a47c3e92f759e8f202429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "005b893c-caef-4744-bddb-f3f97a835fe4", "value": "192:OtEL4on1JlvjgV0Z0b5dJNQiUDE0tXnnozsDqwuT13ZOd4Z3ViNP:OW4onXlbgSZ0ldJKbDE0tXozsDzuh3CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371269, "uuid": "24ec5102-35b2-4298-9b88-0ef3efb0add0", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371269, "uuid": "aad4d763-c763-4a75-abc9-33062afeb78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "529e0dfd-a99f-45f7-a144-ab7ec6f557da", "value": "35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33854563-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786355550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "c70775e4-551f-48f8-b5e4-854ecf23a90c", "comment": "Malware payload (Efimer)", "value": "d56a844710acf7ea3634f90aa5ef4d49", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "4c18600b-5e31-4337-b7d9-f9b77c8d9592", "comment": "Malware payload (Efimer)", "value": "36949ef5549bd8fc7b223933fac780475db87e66144f9a404fa70061e4a2916d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "9f63a95a-3a09-4a72-a1da-dad4a0c09d26", "comment": "Malware payload (Efimer)", "value": "74ff6429b527c1f028dd8cd11f35b9a499085d44", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "fb9a308e-af5b-42d0-8de1-cb9567dda1b6", "comment": "Malware payload (Efimer)", "value": "9913caec5d6a6bf7c169216b2c20f2707f3e48190fba635bd8bb9d8bad0a319499b33a8271a2554f3175b83669f5b472", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "4ef9696a-c455-4faf-9dbc-cd63a6c77cc6", "value": "T14BE63388BAD411AEED6312BCC9D10512FBB5B8BE4730C4EB47FC57656D632A10C3A729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "d926531d-f7a6-4910-bbf9-3986be06c537", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "2e8398cc-882b-4698-b780-73434408c526", "value": "393216:HGmZHJMyUl+szQ1VCTaNnXMCHWUjecuI3/PGTAI:HGQCV+gQLJnXMb8TH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355550, "uuid": "faae0e0e-c1c0-4a56-be56-edfc1c67431a", "value": 14292314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355550, "uuid": "e0620ece-4b1e-4ac8-ae89-5c12a320433d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "205d03ce-57bb-4450-a0d6-c6e16119cbf1", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e08063-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "fb2911ee-3f00-4a36-8da0-6cbdd12236a9", "comment": "Malware payload", "value": "13aa85c7753e1a75f8b3188cc5a70449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "46957f2e-123f-4900-b873-531c854562b0", "comment": "Malware payload", "value": "36d3d96a1bc1f13abbd5ce1ea182a25358999bc3274d9f3998eac5cdc5f3aa50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "06c617d0-f5c4-402e-b8ec-a9f388fa55da", "comment": "Malware payload", "value": "1592eadcf92c7a7b0a31f41570e3168bd1d1966e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "b887bd5a-1e21-4e7d-93ad-0b4d9c1fb5ab", "comment": "Malware payload", "value": "9fa541e08876bed1646c30423bb95de38078bb7ffb0afbd45fa6afe4b36d12cb9360a811cb871010c745b684972fe41b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395518, "uuid": "7555c27c-81e6-4a9a-9257-7e1056c95685", "value": "T12DA43955EC809B95DAD12ABEFF1E824973131B78F3EE72119D061B3163CB84A4E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395518, "uuid": "eb0ef1b0-f57e-4d39-aa23-ffa55c9bba67", "value": "12288:RHHWM+dvq69mrFx14766QVqeCgSPGAAlbg4n1a2jb2s8kK+TUx:x2zvXtK5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395518, "uuid": "9bde0169-8ba5-4716-8bc3-39181dbe0777", "value": 476820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395518, "uuid": "4e57c016-2a77-49c2-8944-147abbb6a639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395518, "uuid": "b297c902-5f67-4110-a849-03a01a0311b2", "value": "rxwp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec38bff-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786372775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "a9b9ba8a-461a-49f9-a814-71690d973954", "comment": "Malware payload (GuLoader)", "value": "10d143bc7a79499d5a11e954d51ca3f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "fb6b1b2b-69d4-4a73-82e6-1b8d2d326272", "comment": "Malware payload (GuLoader)", "value": "373a6410430d15948a76f157d22fda6c5245d0f44d5e770d0b365263d2f3f22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "b8312181-925b-4d25-917e-cbb536880d76", "comment": "Malware payload (GuLoader)", "value": "bdc5c8e131265de9f0de49b356f9ca5e3c0922ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "e46d2772-40d6-4399-841b-ae0a84b650f8", "comment": "Malware payload (GuLoader)", "value": "21b488c08564a3e71e3c14bc33328e9d5449e1327921e960890b9011e54e87248369bb89f5931a1737fd89623a813b48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "9d60b31a-eb98-4394-8025-e1c1fc2f5aab", "value": "T15BC4E0C5BD109176C4AC4736E06EA66F0A6BFF2D01741A4327ACFE2B3A7C752450963E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "8a201387-65d9-48ea-8763-436947ad9415", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "3616f471-b007-4f95-95b1-8ccf82bab269", "value": "6144:dXsKoGYtiurbSqqbyxjPXNOfowRG/VvQ3aOAi1Q48mgNNvHESLsoXDYS5U:dXctpOaxJOfod/JmaKQ4ngNNvHEqha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372775, "uuid": "d9b93b65-73b7-49ac-83a3-f66709a92b43", "value": 564192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372775, "uuid": "c98b3c31-2e5c-4b15-81d0-cc801fdb7474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "43dc68b6-b2a3-4314-820e-1fbbdc3d5632", "value": "373a6410430d15948a76f157d22fda6c5245d0f44d5e770d0b365263d2f3f22a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e5ef89-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "6b25da00-def8-4437-9c2a-ac764a4f562a", "comment": "Malware payload (Prometei)", "value": "2970a8a61e6614818fec183b2e98b614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "0fa11ee6-5c35-41b4-adde-b2b15e509a28", "comment": "Malware payload (Prometei)", "value": "37889641ac36cf081c187dc147939e329add2f571bd41363c8d4e5639bdb13b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "f1c1a393-e846-4f6a-94e7-a8ba91053aca", "comment": "Malware payload (Prometei)", "value": "3ffad3dde380a4c2782d0d4e7177bc8aa841d78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "c1e1b82d-329f-44a9-8032-7d999efad045", "comment": "Malware payload (Prometei)", "value": "c8504c6d6fbb9c8259a750f78886c73f712efd9c171be1257eb69820ef1e57c37fe8743e31649ae59471e77ec0a03e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "ec64a268-d010-4ff3-8272-b36113969e61", "value": "T141445A13B201DC39D75206B1AD9F9B52097A7C391F3316DB73B01AACD6F01D2AE25B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "34a35610-d5b2-4873-9985-632a43b7e7da", "value": "497ec0ba56520a465b1c189de65cd68b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "b42eefbb-bec8-4b8b-bcc2-ae40b9aa21bb", "value": "6144:7rAvsdc+iejBwJsyamsyo2iI0RnemvRGo0AsfZQ:7rAUdc4jEsyamsyo2i6mJGo0AsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327777, "uuid": "4364f188-0625-4d97-843c-0dfa0f6723a7", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327777, "uuid": "c724864f-197d-4ed5-90af-2ee028fdfe92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "95e3c703-197a-48a9-93cb-66ae518c4b4f", "value": "f4ac4f735b9ff260a275734d86610dccb8558d1a54c6d6a78a94c33b6aaf6e39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b491d14-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "b0a782e8-33f8-4285-856d-f58bde248e96", "comment": "Malware payload", "value": "47b32d67a5162f0bb255bf2083582782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "e6260c70-f5bc-4494-bfee-be2183908d40", "comment": "Malware payload", "value": "3870075ada881cb8d92a9d5b37c49b5dd50741ab7faf00985e3e52c769a4aed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "5b1b51f1-aaa1-4b19-8de0-c53087d42b27", "comment": "Malware payload", "value": "c421916e27cbf957eefd0ddd4b20fc6acac0ff4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "b2781191-60fc-4006-8ac3-7ee127e8272d", "comment": "Malware payload", "value": "1f45b9552ea40327f7db8f0b9627a8b2c7eada09e01bc4cdb320193cbb1fa1745d81a0dab41175aa388574db7be75cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "0ed250f5-2b18-4ef2-b480-51c61bac8ffa", "value": "T1D3E57C07FCA118F5D0AAA3318A36A9527B21BC481B3123D76F50F6B82F72BD05D79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "212706af-8309-47e8-88b8-b330a0ce17e8", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "2921c9e4-4f1d-48ed-ab9f-4d5a765b9fa2", "value": "49152:Dl8WXuiExBm7RaXlkxprTUwjuNMQwQuOchgOgnH+5ZP:DlBR4gg1Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373145, "uuid": "124ae29c-12b8-4e87-bc44-ec0fa5bc4d31", "value": 3163136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373145, "uuid": "bfc5e19b-fa3f-46a2-aa5a-a34b83f2fdf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "03bd90c5-04f6-435b-9234-d4250031972a", "value": "3870075ada881cb8d92a9d5b37c49b5dd50741ab7faf00985e3e52c769a4aed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89613ede-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "e24cfee9-3963-4bb2-82c7-545b3fda88f4", "comment": "Malware payload (Formbook)", "value": "976f947588b5ed37b2e65e2f09150024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "09d441f1-abfd-476f-ac13-144a2ed34824", "comment": "Malware payload (Formbook)", "value": "38769a2e4f94e3b64653527637ba7d977a607577c4ef056629f1cd83480a8fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "309578e9-8640-4cc0-8b26-9c0a8ed86e12", "comment": "Malware payload (Formbook)", "value": "c3eb130ebeb2ead2774c3df99eb7ebcb75c06fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "c8fd1f66-a938-4af4-bef4-1ccb04eeb57c", "comment": "Malware payload (Formbook)", "value": "b3dc79659c05d3f4ab542dd902a109baa5a23e680cfa0c80b203074a9ed1022671656489e4248ae0dfff8d0b9115afb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "33b3415c-23cd-45d5-bc4c-f7e5dcea6196", "value": "T1EF252314A2959113D0B75BF899F1E53463767EDEE630C20E4ED62CEFB462B088614FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "40892791-0701-4121-84d8-752573843836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "8ec7acfd-97a9-41e6-96b8-7597dd44bb98", "value": "24576:SJAK+LvrJgaC4ScLc37o/6Rz9AEFoxdeQi2Kkii:xLvrtCOLc37o/6Rz22ox9Jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373732, "uuid": "1ccce85e-ad23-4536-8145-8a61c0f2e6cd", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373732, "uuid": "4369a328-f036-406a-b1b2-9bc4bf33768d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "87e99ff6-7e30-47de-ba36-2669cef12ce3", "value": "38769a2e4f94e3b64653527637ba7d977a607577c4ef056629f1cd83480a8fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1913a1d6-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "cbecfc2a-7c3a-4b14-bdf1-1eb08242fab0", "comment": "Malware payload (Formbook)", "value": "8c54e44dff2fe5fb41cb3a987b86c982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "15add3bc-2e93-41b3-a62c-997f12102c67", "comment": "Malware payload (Formbook)", "value": "387775ca164b849ef3e6db1658e240e02601ec5036a1accf17026791a51e87cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "665ef234-a348-4775-a843-e9f4de2db248", "comment": "Malware payload (Formbook)", "value": "4a1b4fb0876d6fe2398fbba27a3a9358b503a184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "8e92f979-5e03-45e5-8ff3-8113fc427377", "comment": "Malware payload (Formbook)", "value": "1b2c623fdfb304cf83d4c9f41623a3c73b386c08e2875d566525f29f1b3d8a98f2926f1c8c9162f97ca07cca51e7dcea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "b222e537-016f-4bea-b798-8295ee7b9322", "value": "T15325130C5612D413CA565B395EB1F37922BD6EADB800D7139FF82EEBB93AD154C202D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "bffdcf86-19d0-49ad-81df-8c8f70a6772b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "ebdfadf6-006e-4b1b-81a0-b01f405a9e3f", "value": "12288:EtU5UrITy1SAEACPCoZoEetJFWycDrclbxFRZmBB/J00tjVyrVek+lFH5kprz:ySAFCPCk4F34cVJI/JdtBmRCFHip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371397, "uuid": "5fe163ab-a6ef-4199-8daf-5736b66f297a", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371397, "uuid": "efb37188-791c-4e72-a9e1-8e36738bf64d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "33514d1b-583e-4f9f-b443-eafcc74727f7", "value": "387775ca164b849ef3e6db1658e240e02601ec5036a1accf17026791a51e87cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3026fda5-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "0dda6343-acde-4bce-b0dc-339111049dc7", "comment": "Malware payload (AsyncRAT)", "value": "a74f4a593e04a6f840422168d47a05e6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "ca8344ad-f84e-40cb-928f-4df7ead9407e", "comment": "Malware payload (AsyncRAT)", "value": "3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "fa0aec7a-95fc-41d9-bb1d-22f2909f0dfc", "comment": "Malware payload (AsyncRAT)", "value": "e7e3e5b4368ed53a934da69fa76d05b200816969", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "88582062-9c23-42a4-b4fd-d78e4928b9ed", "comment": "Malware payload (AsyncRAT)", "value": "fc44cf0adf747010baacd73ffcfd0d3cad73f954f1313c9c80193eef5f29c935535ef87b54e05bb157bcccad542763ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "3ec87b48-db57-49c3-804a-90f3a0ac5c4d", "value": "T11415CF9C355075DFC457CD768AA8AC70EA206C7B831BD20395931AEABA0DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "fb825e47-58c7-439d-9bfa-8fdbccd41e03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "a574a535-751a-42df-acc2-f78e2b8cce69", "value": "12288:+u5tqgwIWA1vXDfZryvvzKGAe0UaeUBIpBtUoJliXtfn9Afm8zxbfmFE+d5bi+Q4:L5V3WA1vbZue8yqBtUoJluCfm8zxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374012, "uuid": "48237e56-8f4a-4832-abfa-920c014a409d", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374012, "uuid": "767fa3b4-1354-4947-be96-e93faccd5766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "816e0c47-cb34-429a-9833-5033bffcb588", "value": "3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d44dc58-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "08388fd5-65f2-49af-8045-35e19aa73d07", "comment": "Malware payload (Formbook)", "value": "1f5575df0edd58dc0ad1e37f0782dd54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "d1ef9d41-611a-4c25-98aa-fad81963c4cb", "comment": "Malware payload (Formbook)", "value": "389693bb8dc83ab540ce9eac5da510d10e1ae85cccc24d95e60d1a3216f6ec3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "f37d643c-b873-4916-9770-000f1aeb1771", "comment": "Malware payload (Formbook)", "value": "974e7f07e88e2c2d787d0bbc82322b898e71d66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "269138bb-1d0d-4327-ae82-1f34082576df", "comment": "Malware payload (Formbook)", "value": "46c437411ac3b8136d912a1ff3b4de8509bc4e50881eb108f7df3edf46e4177166d6597f5403883be92b360cbcbb8f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "0a342f3a-c068-4c1d-b325-c855a85a0ad9", "value": "T1B03501441312DE42E4D68BB6BDB1E37432A94DCF78E2D2D25FE92FF734293811958682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "937fb0d1-743a-4bae-b71f-00e675e68213", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "372db1aa-83f9-4808-89d1-0019e2154c55", "value": "24576:dDp50T1SbPEacomxlbwc8DiqoRTalNOGQfjQhnjWT:5pO1acoSbwc8DiqoElNzQf0hnjWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373256, "uuid": "de65de5b-19e1-480e-8ada-5171f0b22543", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373256, "uuid": "3d4a891e-fb19-47b1-9856-08b4f7106aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "a6f5e510-482e-4270-88a6-c9a32019f59e", "value": "389693bb8dc83ab540ce9eac5da510d10e1ae85cccc24d95e60d1a3216f6ec3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fd4978-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "a5c1fedc-05ab-4b9c-a30e-ec504c166442", "comment": "Malware payload (Mirai)", "value": "32e534e36fd962953afbbf0f90d37a1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "3ba144f8-2d96-4e9d-ac8f-b8a6124493a2", "comment": "Malware payload (Mirai)", "value": "3905b82afd6b584b30fa469214c6480e262ad0da6ac5cfbace403331454c4a5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "1e14d24d-0651-4cec-a3dc-265f8481180c", "comment": "Malware payload (Mirai)", "value": "520a7ba97fa31d194914dc39305aa3e58ecdb00e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "b3df7e61-e180-408d-a2bb-1cb48f0053e0", "comment": "Malware payload (Mirai)", "value": "3cd2c0d789aa11161cad208f47e1f8beabe95fb280570ce5cddef9a50195639fec04bb8d0ba06b62c99b1e8f54c3d396", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "9c22973c-3d3f-4779-b4b7-c3bd4d860f1d", "value": "T178245CC7FC00DDBEF80FF3B6449B090DB570779514536A3663AB79ABAC3A0851922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "003528a1-a106-4c5c-a666-286383cf8ff5", "value": "3072:hwUoFgytXNWIDRe9rXw8zq2y1FtQ6oDlT6tAZN0OV7jbi6LAbRzmmuFVjKHq:9o/9ZUzw8ny1zQ6oDt6gN0sLVHjKHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356946, "uuid": "0fdcd33a-8b85-471d-bfa6-6dec07eddc9a", "value": 218168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356946, "uuid": "493f906d-501e-44b4-991c-10c0d354dfca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "e3c6a5d4-a3ce-4935-a077-0083aaee74b1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc315bc-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "c9447d45-3894-4db5-a746-f19dcebdaba8", "comment": "Malware payload", "value": "0429f6275f4d8bca3b8ac7822fe83592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "0eba5bed-09a6-4a52-97c7-938e9b600f39", "comment": "Malware payload", "value": "39124e4f7013e8ba5c158b4afdb9a73c1df451367cf8b724cc2fea49eaf809ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "f1bb4400-15bf-466a-a6ab-25a3586d491b", "comment": "Malware payload", "value": "9142c6eed0c6e955352051581b7eda17b0006241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "b17e1eff-56ea-4e60-af8f-76485caa5065", "comment": "Malware payload", "value": "e90293c70174e943f909777d2e2f5a23b772052ae4c1974e17b8d4bb2ec36eea119db605fdc64832c22b6aacbfe25792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397201, "uuid": "4e77a1be-df26-487b-8b15-45c6b7c15e9e", "value": "T1EB633A41E653C0B0E19381B009A7F7E64534DF36941BEAE6EB9C3D62FC307828D9662D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397201, "uuid": "769f3203-7795-4f3d-a9fd-4595c858edcc", "value": "768:LWriT9iEfTLQwDQRGAuAnhbcpUEE0M3jT0S+3qPa4G39HvCScStQBxNhtjCZ3ErK:LWr29iEr5DQR7nthrU5dvjtQBPjCZUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397201, "uuid": "c87d8a59-757c-4f17-b194-53c913281b59", "value": 70440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397201, "uuid": "986f9850-e3e4-48b2-b52c-3c2ecc3e9cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397201, "uuid": "c78ae43f-aeb1-4ee9-ab66-2a049fde80b3", "value": "main.x86-i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70edcb5e-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "2540f08a-54ae-42c3-a0a3-af81a4814d99", "comment": "Malware payload (Mirai)", "value": "0a10f34b26ebee0bb6e120258cfccc8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "125ebb81-1ef3-42d0-8dc7-45a3079bd4f1", "comment": "Malware payload (Mirai)", "value": "39199d6c565b890e2ebd89a9c0166d931a64cad70080581626856e58f3f48fce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "fbd31501-ce5f-4730-8365-f29e260b739c", "comment": "Malware payload (Mirai)", "value": "005b863a21e5e8810fc36ba29a2bdd0eae292167", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "9377e8db-a56f-4bef-af52-d16f0e3cb466", "comment": "Malware payload (Mirai)", "value": "b1447e0655a7cce1b4066a9252abba94c30452344194752ab292054a9b7b42cc9e912f88ff1e00797dbe734385553550", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356941, "uuid": "c65136a8-47db-4285-b9e5-243cc3d7a5ce", "value": "T14C142985FC519B12C6C712BBFBAE028D372A17B8D3EE31039D215F25378A95B0E36546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356941, "uuid": "b7c9515c-7343-47ef-90a1-6c9d1bf82f7c", "value": "3072:Hj4fN6aCPMRfTOi2YfKEomAQ8/V3Yu54UV0XTf0Y7tgbP7:Hj40aC0JT1+fmAQY3Yuf0Tr7GbP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356941, "uuid": "0c31b2d8-f4b9-4d7f-b95f-54b2d90e7abb", "value": 195160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356941, "uuid": "2a8c3d63-bec6-4854-974f-ba74c7f2b27e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356941, "uuid": "7000c0c0-3d20-4a18-8eab-5518554a74da", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f252cc41-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "233dfca4-86af-4c68-a7e6-97bbe79d00d8", "comment": "Malware payload (Mirai)", "value": "6b4bc1b21eaab2a3b0fb94dd0d8013ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "8047fed9-9602-4198-a17a-8af19664d2f0", "comment": "Malware payload (Mirai)", "value": "3976eda2ae8a095f3868ad94d8b28e8bf3019298a73097a3a124a6f56b687b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "801a22c1-ccb2-4238-8601-073df19c410c", "comment": "Malware payload (Mirai)", "value": "4d371305c419a7639c7524e5ef51bf8b426e92b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "77866d08-81f6-4efc-9f45-039a50f42c6b", "comment": "Malware payload (Mirai)", "value": "cbdce36ce8881ca6f32b1e21e4951a5b00e6ce68ba04890dd75f2ca14f168fba2cb7eaefcc0d95e5e041bf89c13bf5d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328382, "uuid": "25810692-cdfd-4e86-9864-ccf579c776c2", "value": "T1C5131BABDE0E3941E3D4E338E7590BE1A02F7934D29680B77E42718DC4ED9DD8D92252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328382, "uuid": "5ecc797f-69af-45f7-b75b-7cafca2d50e5", "value": "768:Zv/i2+QPNW5cKy47DaLs9ykjiA+PfcZplFxLiYBZoCT8la6J:ZvMQVFtKDDyk1+nch+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328382, "uuid": "9c47186d-d6de-4827-8a24-d61b17b6b434", "value": 42048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328382, "uuid": "383ee343-d6fa-4610-b729-53fcfcb0a34c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328382, "uuid": "e54b275c-1396-40a7-a1a0-b9591d4fcf45", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015f71b9-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "45f6dd83-a0ea-47a3-91c2-02b4eb98b667", "comment": "Malware payload (Formbook)", "value": "8a003348f92301a8a49ebf51976a86e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "5ee26956-1796-41c5-b771-dbcc73f95a73", "comment": "Malware payload (Formbook)", "value": "398cf99253297f4791590cd85876db5e36e6fda316f56c6230306ef0e8d007ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "4420a188-73b1-4f03-a2a8-2e879ccdb810", "comment": "Malware payload (Formbook)", "value": "e8af337abd24dc48c11366cdcbbe9a187e100ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "83eb3cc6-0619-400d-97e2-71ec677a3231", "comment": "Malware payload (Formbook)", "value": "a4fe196fca47dd223cb9ff566c2138922bb7392d0f011441f438cd1e33ad3341a80189246529583060933280046a44b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "16039985-6f87-4d7d-819f-597794978f87", "value": "T1D3251288A785CA13C99813394E71F3BA21A96EFAB800D3478FCD9EFF7975D151E08152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "f30f8841-cf27-4d6b-94de-3d1c75e05490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "bfd2f500-1780-42b2-8368-6641ca3da374", "value": "24576:LoQzULAoh7KSL0ibrQmW1UuhgVbi3oWCpR:0AYA8K60+W1RceCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371357, "uuid": "a7e4ca77-8cff-41fa-9262-cdcda0b624fa", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371357, "uuid": "1f352b3d-4156-4842-85bd-9506e85c0fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "2fa43805-39bb-4d06-9aec-eed2a70526ee", "value": "398cf99253297f4791590cd85876db5e36e6fda316f56c6230306ef0e8d007ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4badef46-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "0f6727ab-e8bd-48a2-816c-f9e45c731698", "comment": "Malware payload (AgentTesla)", "value": "41a5ff96c0ff85d002f92a20fcb623d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "5588e60f-1f4a-4d96-b09f-699bc51d3ec5", "comment": "Malware payload (AgentTesla)", "value": "399e354cc4d22098785ca425fdf1a7a387aafcbdd49c64c026f813a53084bc90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "90ac953c-8384-4250-b6de-1cd12716df26", "comment": "Malware payload (AgentTesla)", "value": "28a4334fd4d99c3b678ab2a49c1e54f057924db9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "c4cf0ea1-ff00-4d44-b77c-2ee01b65d796", "comment": "Malware payload (AgentTesla)", "value": "9ed92e1e894d7965ac7437ac36ba0210b0284742762250b2167dd4d85ffc01b0063381f97c32965adc22c140bec377ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "5e09b0eb-fd99-4991-a44c-f9b406f69376", "value": "T13D64C0A1F2D9C8DAEC51223159BBDC3215576E2DA871591E312F373AADB3393006BD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "5de913eb-3449-4ec8-8769-60292008cbc9", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "3c33f369-633d-4f26-9b88-20220276b4bd", "value": "6144:ngORaspjQelWMnWR1FsxtcB3UOaZwMAHpbODsjH:ngyjz8R1F8tq3XaZR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370622, "uuid": "2b5cf988-cc82-4512-bf71-a65610be0392", "value": 333080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370622, "uuid": "26fd521d-66f6-485e-b747-bfd09b466c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "5001a38d-fe97-4323-8cfe-44a3da47930f", "value": "399e354cc4d22098785ca425fdf1a7a387aafcbdd49c64c026f813a53084bc90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300c9e26-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "6535667d-4822-4bf4-9b44-5262321a3477", "comment": "Malware payload (Mirai)", "value": "64ea8f1e2678b43d19b9ab71843d74de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "b9243944-04b7-483a-a605-e5fe7e82e837", "comment": "Malware payload (Mirai)", "value": "39f3387a804707e27cebb905aa0a000deeb7a031d87d69ba22f022238a16e515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "6405741a-bd74-457c-a2bf-2f83b07abff0", "comment": "Malware payload (Mirai)", "value": "f03f9e5009de6bd2bbd10c8c9b44b0438a244c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "46d398b7-0ab4-45e6-bdc4-436afcca637f", "comment": "Malware payload (Mirai)", "value": "dcfe027c17c949cefaec0bde2e3412167443f43d0fe199e94fb32c14d8e9fb1cb0a73daff05307d647e14a31de3da0bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353826, "uuid": "ebef040c-74db-46eb-bb9d-6b01e630752f", "value": "T1A0142B05E6404B53C0D327BAF7CB434A73239B54A7EB73059628ABB43BC679E5F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353826, "uuid": "b58a0652-2a1a-4b9f-bdd3-9792483e9ecb", "value": "3072:enBrwO2vLsNGwJ3eTaEy+CC3KpWTF2E7IK5uFxGHrM/RW6KQejQZGRuM:Kw1okwJuTaEy+CC6cb5ujgrM/RrKoGgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353826, "uuid": "87e1e8e1-b0dc-4757-b162-0cdfa5a0bec9", "value": 194083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353826, "uuid": "bed968e0-537b-4953-a6af-ae1ba6b467f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353826, "uuid": "5aadb4b6-9ff9-4255-9a05-bf58dc54fc8c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f919a58-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "617c5bd6-16ca-4a7e-8c16-185aaa0ee4d4", "comment": "Malware payload (Mirai)", "value": "f03b21877f0d7aa7efba2be5a2cb3c2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "b4d1598b-acb9-42a1-b76a-5410ebbef6de", "comment": "Malware payload (Mirai)", "value": "3a6a71f4046b8a5323b9b46229a2373376c8b0092be4ada29c2c518737031de4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "afd6ff78-99c1-4f85-8c7d-d976c2a22d94", "comment": "Malware payload (Mirai)", "value": "7612a1735137223df469c7255ff951bdce255540", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "9aef5c40-fce9-4ad5-a802-4bc2d89213b4", "comment": "Malware payload (Mirai)", "value": "4635259c0bf17cc518439e98cf108c65ac4f19a7f2f40f0946f54efc51264f730233b5ee572708e83940242580f724df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "a51eac96-1866-4f1e-884c-b4e90b902dab", "value": "T1F3730279A36AEE76DD7698380D9647907552BC0F3D10415B7F8032BCCA78993F286273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "9fac120a-5428-414a-9842-2ee51bb734a1", "value": "1536:fbjVbcml1gfRbWNXgIgoD6zurece2bA+lJl69hhINS+h:XV1eJWaLAiOecfbrZQIsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383594, "uuid": "00ec3933-b97e-4db1-999a-f45d57f93889", "value": 77208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383594, "uuid": "56272d94-7f8c-45a4-a228-4da3f4b34fc9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "0bf66d69-20eb-46f2-bfa0-36d7df5c5fe9", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc4f74c-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "78084172-dbe5-49fa-a769-f4f3ae3d756a", "comment": "Malware payload (AgentTesla)", "value": "7d9c626d3a9cba22a33944fbfe985b7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "8f073d45-d9ec-4263-b78f-6dbf68afeff0", "comment": "Malware payload (AgentTesla)", "value": "3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "697e6cdc-49a2-44a7-8d32-e297ba6f0892", "comment": "Malware payload (AgentTesla)", "value": "a0fb6244a9ba3f8790e69f1548e09305b45e6318", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "9822721f-8631-4e87-9deb-ba72425dce01", "comment": "Malware payload (AgentTesla)", "value": "fd77ce02c31b19cefc4d6a9154994953cd4d1828dffe1369ac469221b4f2d480555fd5edbb47385a43f1ee08994bef4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "39691330-f776-46a9-9a22-b20f4082bb74", "value": "T1BAD42351B39484E7D2B209B00E216B375523DF374EAE7B1B8B60796CBD766867C0CB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "2cd16180-a84b-42f7-8978-1e3b217a8557", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "aabf131a-c2ff-4e44-a0d6-7a8e035f06c7", "value": "12288:gX42de5lr9UsPD1a7xL9ZKQivFj+x++mECjXOszICWnxJidSKi:C42de5lr9UgJcPZKQi5+mECjFzIC8jo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372072, "uuid": "e2e93936-0088-43e2-b287-8e79edcd6535", "value": 623232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372072, "uuid": "5064ae43-913c-4f0f-8668-0e656bad280d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "b13b2064-c3c4-40cf-b9d1-9e8fa2ff6716", "value": "3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7adec82-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "1693de92-e566-4b51-97d6-0c00b7f95d79", "comment": "Malware payload (Formbook)", "value": "32ca833b299dbd21b7dd7b6e6bc97e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "da719ce1-b98a-4f6e-8740-fe601e0bae0b", "comment": "Malware payload (Formbook)", "value": "3a96f25feefbab52042aa5768020b128bdb7231cb3f8114a01fe23e6c873071d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "77650aa2-cca0-4290-9004-7b4a8eba77a7", "comment": "Malware payload (Formbook)", "value": "c06073be75f1c5abe61801c9a26e845be062a17f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "e13f0443-4e8b-471f-bc63-6018b29c4657", "comment": "Malware payload (Formbook)", "value": "a643d1dac51187221ab4eec2f2591bee5403f9e334ff5c9f1ab4adb4a16b75f764ae10904d0cffd1a7c1fe656d07e46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "649417af-2ea7-4336-a783-c4943e3f8aea", "value": "T1413501A41346D992E0D287F6B8B0C37472741ECFB9E2C3C69FD96FB7B5293811604692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "33dc124f-2942-40f5-923b-6266b7d35f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "f2797ba4-3996-4556-a5df-6f092ef1ecc3", "value": "24576:AZylp50Dp+ZswOlnjqJaQfoBkwqxIqu0P5atuxV5DC:ASpHswOljmaYSkwqxIX0Etu3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373461, "uuid": "73e1ec99-47d5-4d68-b9e2-aaa9ba31f3e4", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373461, "uuid": "91988763-2de5-43ab-b8cc-04b63518cd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "499863f2-2968-4076-ac3d-c391ee06127e", "value": "3a96f25feefbab52042aa5768020b128bdb7231cb3f8114a01fe23e6c873071d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630e86a9-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "e61c77a2-c701-44b7-968c-bc81eaf2d211", "comment": "Malware payload (PureLogsStealer)", "value": "1afd90b21bf1b66e587dce404b1cdf2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "7695e82b-42f9-4b74-bb5a-7ab868ccf783", "comment": "Malware payload (PureLogsStealer)", "value": "3a99c6d83534846f404de72c6f527c964b2235a6b74a8698a688d999c224eba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "a98b02b7-ce49-4168-8b40-e213f0a56738", "comment": "Malware payload (PureLogsStealer)", "value": "f2665ce49a97ad8eec018187fd37fcd0b9d3cd78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "659e29c7-dfd3-4c9b-90c5-2cc533437e26", "comment": "Malware payload (PureLogsStealer)", "value": "8562933b478698568f9265ca92dbe027276ab9f2f152a11bdd12ed1f7e7ccd876f87998778e03c77aec70fae41f180f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "c9820dd4-782e-493f-b065-e4a56ca628af", "value": "T14605CF2B72928F31C24A5272C1C7890187EA968366A7F71F71C503E61D433FEDA4A6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "818d6d35-429f-4af6-b020-82ff860c7b61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "26dafe85-70da-4466-9942-e0b702434fe9", "value": "12288:rq2IPa0sJj8pHHmrqBEgj+mSMGF9lOA3Mp/7OZcHRgh7:rwsJjKHIij+mUFDOae/7OZcHex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373668, "uuid": "81076fad-6457-4a92-b1a3-2906c1fbe8bd", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373668, "uuid": "040039b0-0974-4c96-ad10-665269821502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "9767c5af-d025-4963-a8e1-eb1175ed44b0", "value": "3a99c6d83534846f404de72c6f527c964b2235a6b74a8698a688d999c224eba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260289c7-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "4fde59a1-b9cf-4e95-be2e-52f8c5804300", "comment": "Malware payload (AgentTesla)", "value": "27ade9b15e4d61ac546ab57f8cb82982", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "b8ffefb6-4d1e-467f-8284-e8dbbd2653b9", "comment": "Malware payload (AgentTesla)", "value": "3aa519838c38d7b056b5cc2da23cd0dc26883b8100414b09942af1885a1aa57c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "c7e2b3d2-6a9e-4d3a-a338-1afd46caae01", "comment": "Malware payload (AgentTesla)", "value": "945b94aaa57efe52fab7be0d54c7dd2a4d9be746", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "a119dec1-26d6-4d00-a12f-c55676dd80af", "comment": "Malware payload (AgentTesla)", "value": "0f6ed8e27eff3cef3714d1fcce92e0121a146a80ab802b6dbda5ace44e96cacb6db8a2177fd71ddb1f9907d6d0dbf9ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "3fbee3b0-f60d-4d2e-bdcf-e321ec296372", "value": "T12425F1142356DE12E1E6CBF6B860D77036B50ECF39E2C2D65EFA6FE7381A3811544682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "01638ea0-5e75-41b4-a007-accf94fa9fc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "ea670ce8-363f-4432-abaf-4fee5315cc71", "value": "24576:K+p50HS4noeqO5bOfP82pBt/7195buX7IGQNwVtEJdNB1:bp6kcipL/X5bfGTbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373136, "uuid": "f6233495-3027-4a8b-be65-b71da459c0c1", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373136, "uuid": "f4a02a3c-189a-4f25-92ab-b778e9f0f2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "10b6c9d8-95f1-4f0b-a267-78565c42d841", "value": "3aa519838c38d7b056b5cc2da23cd0dc26883b8100414b09942af1885a1aa57c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71ec5f2-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786373809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "03e6c88f-ab5d-48eb-b183-e37432354d5a", "comment": "Malware payload (Vidar)", "value": "6953009f18f475899b52cb7fc69a712c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "934bad46-01dc-43ba-8c78-fdb7f2c1de01", "comment": "Malware payload (Vidar)", "value": "3aaa4551b2e750fed6432b0fe1120bb945a3a1a91e4a9d08dd33765c60d3554f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "88d7e5df-7192-4b93-8606-afe53c319f92", "comment": "Malware payload (Vidar)", "value": "66248570ca9fdb34b56f528924624523fa222452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "8730bf2c-a61e-4477-8643-9734b02ffc91", "comment": "Malware payload (Vidar)", "value": "3f622919ce35f76a907da01f058c0f6b2b4752ba5b65c9d7325d44629ca5c16cccd5b95e736e9e08b9eb4d861a6a6c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "04990a4d-5b85-4c39-bcfe-bed887763262", "value": "T128067C13EC9158F6C099A23189B396427B75BC0D1B3637EB2E60BB782E727D05D3A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "cbdd1eb4-d807-4476-ad39-ddf6fe540b69", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "9f67f36a-0423-4c2d-ad4d-9d3d0bbdea8d", "value": "49152:/8qK5fq4XrgI33xb05dxB/hhp0EgrN7OI+rvklR/HCh8dDRY:/iIid0yHoZqRPW8dD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373809, "uuid": "4dc8ac42-fe43-4572-ba23-453d7184a7dc", "value": 3781480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373809, "uuid": "8154722a-fd95-47d4-a253-fe44b530540c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "ac7fd5ac-bf0b-4820-8fc7-e9f3f4facf19", "value": "3aaa4551b2e750fed6432b0fe1120bb945a3a1a91e4a9d08dd33765c60d3554f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76c32cf-94ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786389325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "fd783f36-c81a-432c-80f5-12840928c004", "comment": "Malware payload (WannaCry)", "value": "a67c58e1e7613f7ac048929aa0b2fb85", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "91ba94fc-beeb-4c58-9cb7-367351c3da9f", "comment": "Malware payload (WannaCry)", "value": "3b4607b7a1a0b179b4f33e798fe7c2cd2c758ae39c22627680299782c18d195e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "ee750cb9-0eca-4771-84b6-0752bf4e56a8", "comment": "Malware payload (WannaCry)", "value": "65d20b4dce3faf273d80d68a6f53eefb68d955cd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "cec01e7c-ecfd-4742-9434-2b98af9c530d", "comment": "Malware payload (WannaCry)", "value": "81cdbcd83f47c248113caa350b75a1da852bba2ea85dbf1f088328544b44156c0ffa67a99d9b9577e19e97e5295c154a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "79aff3d8-a24b-4851-a4f6-b1ae79919d80", "value": "T1E1161219FAD4D0ACC10B1038A56ECA9F73B93C09036A4F2FB6847F156E773459A1AEC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "5cd0a34a-a10f-4093-8016-a6d496d20904", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "db8c1f39-37da-4438-88e6-293e21a61f39", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DXDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389325, "uuid": "b2a6de90-45d7-4f96-a680-eac96bed03c2", "value": 4032512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389325, "uuid": "bd4dd7c9-7ec6-4d4f-87d1-e81620025674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "f8e1f8c8-fef3-4754-b157-4c2d7afb7133", "value": "3b4607b7a1a0b179b4f33e798fe7c2cd2c758ae39c22627680299782c18d195e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27198e04-9515-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786405350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "335d070f-ab14-4397-9b93-2c3538841610", "comment": "Malware payload", "value": "ad6da42cdfb20da64deeab2d1f59ff85", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "4ff4abb7-142d-4d73-b16e-3da885de8f45", "comment": "Malware payload", "value": "3b842c26338a3e6c1c76f358f7df3876b1a71f211cb8e5294ae8e1471d0aa526", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "55a92600-1e48-4495-a06d-fe7aa67bfde5", "comment": "Malware payload", "value": "c202078a43ec5a0fde713077acd259abfae5d284", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "6ff3c3be-9c41-4caf-9063-ab659796d7f3", "comment": "Malware payload", "value": "dc4a2df85b3bc853299276be3707c1632087504025b4b38e417bfb39c5a3b47e468de445373714e8af52fe109632be6e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "c337ec19-bd91-4fdc-884f-7413570b7016", "value": "T1129412A1DE7541FDC01DF1B0172A2299D8F1F0818F5822DF6B286271AB70EEC6B7CA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "d2bd3306-3877-4a20-91e0-5c3afcba59cd", "value": "b93bf499ed2f500909ebf8f70559e1b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "1176d8cd-0c36-47e4-8526-54d47fb0a4aa", "value": "12288:5/0IdBI/e98XO920iSIBRimORzRtwXUVVzmhR8F:p0Idu/qDaSIXim2zb/Tc8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786405350, "uuid": "b7fc316d-6f02-4057-8679-2f3ac6b7c6ed", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786405350, "uuid": "9583a363-bdb2-4fdf-a72c-0e8535c67669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "314fb65c-786c-453d-a6de-80b99ccf3372", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4af81a-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786383594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "00d3da40-bf07-4730-af0d-69674b698355", "comment": "Malware payload", "value": "12ef1d1433bbcf5e116f58a4907cc671", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "c3a982b0-76c5-4810-bd3e-2620278a07e5", "comment": "Malware payload", "value": "3b8d687bbfec3302f53530f0db2adc7926905eb4cb11512a9e6fcb3a8f623aeb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "5dc148c0-8e8d-49cf-ad29-38da1a950c4e", "comment": "Malware payload", "value": "dcbe641ff1b8b652fd8e6426818b559a3c5fd85b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "48dcc0ff-b6a5-4b15-90ea-863397920d09", "comment": "Malware payload", "value": "5c387890160830fa2703ebf3b40a7a1a1d441139fa048bd01c029b34a817eaecfa0220591de6f80315361b1903fa2e17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "8331033e-0d0b-4cb6-b8aa-5e63b9a34196", "value": "T187E0EC5925926FB7462DCF0FB07A4B395046B194D0EB76A86C0BBC3DB598609F40BB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "99ebb42d-1390-4f8f-bba3-9e265adf8b1c", "value": "6:hZAUvtlvtfV2ICFRcUvtmI1EfMvtmIU3eFay3eFKXiJX4iv:+I9I+/IW8X2Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383594, "uuid": "8163ea4c-68da-486e-a606-e471b5ebb3e1", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383594, "uuid": "7744e8f8-7756-45fb-ab3a-6fbd8652cff2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "e7e90d43-6323-4ed1-ace7-baa3335058d5", "value": "k.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbc2d32-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "bfccd154-53a5-41c7-aab6-552d61fc29de", "comment": "Malware payload (Mirai)", "value": "64513b17b75f1afd1bc48c8dcf40ece6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "9461bc9d-a903-448e-a284-11db3f533928", "comment": "Malware payload (Mirai)", "value": "3be64adb8e28c8c263f8d351a19c294f92364c924f6bde62337a213ef4da5323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "182e3ba0-5c86-417b-8f41-f1d4d1c85baa", "comment": "Malware payload (Mirai)", "value": "27f9cbc52371309af974266ca2eab1543577edee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "ee047954-09c2-4f85-b953-40012f5477ee", "comment": "Malware payload (Mirai)", "value": "d546953a05c9340088f24da1794248e32698ca6a995101465a07ac054cea04d09539867c28fcd1cd086213dcf53d2127", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339914, "uuid": "f635ea46-5997-45b0-9582-50ed3a2c9c94", "value": "T1C1742A4872F1E2DDE158EA745316BC279D71553730A3728B339EBA7327B70804AEDA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339914, "uuid": "3cc8a58e-b336-485f-ab86-9ba602ac7676", "value": "6144:fa90a9ja9wCpEifC+twbKAI0QAYgLnQDFC0Ppll:fa90a9ja9w0CJ0SQhCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339914, "uuid": "6d7504b2-3891-4afe-a340-35883af79114", "value": 359320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339914, "uuid": "20fbe083-62b2-484a-9818-9242924cc8e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339914, "uuid": "bfc87c36-c71a-4887-8bfe-03bf769047b0", "value": "x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c1b315-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "94f829c2-1b9b-4e81-aa37-ca262ec3e830", "comment": "Malware payload (RemcosRAT)", "value": "ed552e44a88690a9e313d72850416359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "7d11d493-801c-4849-9666-917b24716c7d", "comment": "Malware payload (RemcosRAT)", "value": "3ccb005c80531d21f8cfdf7823f55b16a55fc83a8b05935224b89f3aaa4e6320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "818b4755-d003-4e29-8a6b-612dfd78ab8e", "comment": "Malware payload (RemcosRAT)", "value": "0e9a9aadcd5485ddd352f3e5194eb13b3fe8bb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "55cec5cb-d066-4b65-8f9b-fd27e2908cb0", "comment": "Malware payload (RemcosRAT)", "value": "70cabae4cd61ff3b29ae109b01184de2ddd209e6df851e23f3601d67b00f3ff2fead88bf1069aa981433b7f0618158c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "8b8ef9a1-6f36-4071-882b-68c15b6d5705", "value": "T178551258DB05E102C88617790AB2F3B542696DB9B811E707AFDA7FFBBEF8D101D04192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "6ec1e7a7-995a-4e64-9e1c-7842df2bd537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "a3bd9d41-e0a6-4e2b-848c-ef292e8cdb9a", "value": "24576:7AUfaFK0E0Ot4kmB5GohfjnSFJWb4GYka5qjLH3P:cUiFK0C4R5GohbnSFsb4HmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371409, "uuid": "ee7682bf-6526-4f20-bfa1-2a7489cd8fc1", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371409, "uuid": "49396d41-5ff5-40df-9373-94fabec27c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "5265c127-c8c4-44bb-a1a5-cd4a3ddea5fc", "value": "3ccb005c80531d21f8cfdf7823f55b16a55fc83a8b05935224b89f3aaa4e6320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3367d04-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "64105f8f-a4a9-4d15-a578-33b550a03fed", "comment": "Malware payload (Vidar)", "value": "083ebe6a81aaba44b4d1f56eebd51e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "25ed643f-5a8f-48b2-ac4d-e97137b70b90", "comment": "Malware payload (Vidar)", "value": "3d2969f2e116e37326ef25efe70721d27cc39081bcf8e850dc4c9dd53b1a13a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "01f1a069-321f-427b-9fe8-974b2e71bc7a", "comment": "Malware payload (Vidar)", "value": "7630391990cd359508b797a9adc07ffd1ad88be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "063789bb-8dd1-45a6-a033-4219ccfa9152", "comment": "Malware payload (Vidar)", "value": "6da09ad7d91ddabdcc15532b8d7ecb7eac6ba9bf324a99560c9b17b6af6a207fe533d534d0b0f1bd7ff543efbebae4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "b0eebd26-870f-472d-b395-0ee48bb48388", "value": "T1C6422886B295D0FCC1BBC274F8AE10E7DA66304603164DFF73A594402BD2254367EABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "11f8a277-fe78-437e-98ba-6052da985125", "value": "f6372b356b11b44f58d86bbbe9d55263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "33ea7772-3c72-48f7-9fd8-c6e95c329dc8", "value": "192:1FyfdJz6vf9wimidl4kZv0Ysgl88/E8PGn4vzmPD0vU5c1n1OV3VwCWj:0MTmwP88/E8PG46PNJlwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372085, "uuid": "5badf791-6e11-416f-b472-76a1200b657e", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372085, "uuid": "0bb17ecc-1c1f-47b8-b3a4-d52a9ac945cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "37f2ab12-45e0-45d2-8e5b-268a6cca09e7", "value": "3d2969f2e116e37326ef25efe70721d27cc39081bcf8e850dc4c9dd53b1a13a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f75c9e3-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "380e5876-7444-4ba0-98bd-5eba1245b946", "comment": "Malware payload (Formbook)", "value": "16300b8f89700f85643b3b3d6b13e86a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "34852508-aed7-44d0-9116-02a635044e7f", "comment": "Malware payload (Formbook)", "value": "3d87a298c1dcb34d5fd1221ef3991d138ea4708df1597ae32983a1883405a6d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "5eee8e17-7127-45ad-aac4-e70ed42afb00", "comment": "Malware payload (Formbook)", "value": "f5c1b43c73cf3ce4599c6b7c98f9280013931bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "024fe724-e2bb-4a6d-9c33-25ee5e31a891", "comment": "Malware payload (Formbook)", "value": "fec2b359800780fdab06892a5c50d7f4e88c8c644877a28d1cd3a97161e88977e135f68fbd5952dedbb9dbf875720eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "260371e0-6bc0-463d-9710-a3f1c8647f2b", "value": "T1B83512D43B29B719DE6045349939EDF902FA2DA4B024FAF61ADD3B4B79AD2009D0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "7d3c68e9-3736-4d64-83e2-7ae576ce7b93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "fbdec4d9-5798-4a06-a42d-f3915293e9d2", "value": "24576:Z1B62QIxj0yogETxhA5S6xwju+p74aNIuMeoe911qtaCkRdEkawG1:ZeG03A5S6wRp7hC08Lki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368508, "uuid": "2dbfc3e2-c5f9-4528-9a90-a3dae61c6e61", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368508, "uuid": "429d1163-6e8a-441d-9df5-70dd2dd0478f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "df4d17b7-29c4-4d30-9371-252cb94659cd", "value": "3d87a298c1dcb34d5fd1221ef3991d138ea4708df1597ae32983a1883405a6d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e87950f-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786330308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "a743e489-b729-462f-ad69-5be5a0cf2eff", "comment": "Malware payload (Mirai)", "value": "9cacc84da036a04955a69ec61d337943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "610b48c6-9279-4826-80fe-549b6cbc46e5", "comment": "Malware payload (Mirai)", "value": "3d9b27a3bf639f2e626b3b8dda083f263e1c0cf1e57bccb7a5ff40e8ff3b8191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "a2cedef7-c65c-4a80-8df8-f6d3497bf944", "comment": "Malware payload (Mirai)", "value": "0c43cfce829011713ba93e4a7d3b7a41eb57324e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "26591506-e6da-4c81-b152-b924bd0b9421", "comment": "Malware payload (Mirai)", "value": "2da831bedf63c4234c72104cd0f084fd55cd6083a568fd08c2aeabdcc23821d836ca2505065866b3830268442e0e8990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330308, "uuid": "05b76ce3-a172-4b37-ba78-2571ba3feb94", "value": "T12043F232D19B3658A3D01C3FDE7D0D87608732B646B627C41A3B011DBE5278F9D698A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330308, "uuid": "c34079b4-e1e7-4e15-ac3d-0150eb9152f3", "value": "768:QjO6tY3QKoPlyzOwUwvjK83k25vY3M+5+fob402y+Nz4Pq3UIFrEUnnIxJ8632Sa:T6GtoNGvWOY8/fBfy+Ncgp1d6TMXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330308, "uuid": "401ef02f-9f94-4e2d-af71-10ed4beec739", "value": 58312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330308, "uuid": "81849266-c0fa-418f-8d9f-08f684648b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330308, "uuid": "a910a627-1101-41c3-a2bf-97484f078bdd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316b4550-946b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786332353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "f906041f-75fb-4961-bbc4-9e08585d6aa5", "comment": "Malware payload", "value": "947fab6ba35bb555f592084cf445ed8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "831214e5-a464-4a7e-95f9-ff9ac755d1e2", "comment": "Malware payload", "value": "3dc20f151904e6a4b389076036cde9c1b87068796e28c030ed67e03bbc046cc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "72cad6f5-12a0-4d5b-9f62-5e37e43a8650", "comment": "Malware payload", "value": "6bdc9d229f9e3394b0de882adb34cac33e1e23f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "df80af34-ae93-427c-b37d-275c048f117e", "comment": "Malware payload", "value": "88cb1d788f95825785e381255daa90d442602e46feaa4b0964308b8802b6f0f1e5a24391636d1a4367d5fec90634751f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332353, "uuid": "c17b0b50-ec19-4124-96b4-c98c1934f8b8", "value": "T1DD53D50F7C1E8AB2CA929634C63F00511655CB5154BB9F323ABAD61DDBB212BD31BDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332353, "uuid": "76cdd5b5-ca56-46b6-9ab3-cb5d849b5db4", "value": "768:tyknCuoJVldwMbRiQx9fw3kagMCx1ImPXm9I52jqjl3UeO9BTv:tykCVI0iQx9HMCx1ff52jqjRfO9BTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786332353, "uuid": "2ff082fb-6917-4cf4-b6f9-525cb9a13686", "value": 62124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786332353, "uuid": "18a9e6f9-5c2a-4efd-8f84-1f7cce536df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332353, "uuid": "9cf4d21f-e2cf-4574-998c-1ee212639aef", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38be74a-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "3037487e-b9a7-4a6e-af06-fafd00632d33", "comment": "Malware payload (Vidar)", "value": "777eb9000d1e315eebbc0a5af2b021ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "b428761f-72fa-43e5-8cad-a1054d7ff3b5", "comment": "Malware payload (Vidar)", "value": "3de3efb60114bd192d2454a66f8089403dc2736379bccabb5cdac86e4ec702c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "070ea13c-aeea-45e8-b567-ad384d11ec78", "comment": "Malware payload (Vidar)", "value": "7b741466a5aaebc15952864eeb4891ae68686e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "4750bbd6-6894-4110-9d43-e1f5e3de0ff5", "comment": "Malware payload (Vidar)", "value": "935244a823dd4562a4ddd0a692a6fde88a680ae6ffe24252622ce51566714c2cf7a6157128cbd0e60bbe3a9d9c40dab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "cc4b2ed9-2ef3-4585-91cd-b6a4cb5d73f6", "value": "T1E9923E45D11BAAE1C0D6C337A35952A325FCBD242135AB3B9BEC677A4D52330E7802ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "df0c2744-e30a-4565-9f99-6a4951cb4764", "value": "25141296cd904157b75686c0bdb5f4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "dc917497-2a2c-4b5b-a63f-7d10783d7650", "value": "384:OL/eq4mQpd/ZmZTHN3BRl+a6j/HjkBL8l/:yeHzwHNMVbmG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368247, "uuid": "7f21dfaf-a905-4421-901f-2e7ba666c53a", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368247, "uuid": "fd64e7cf-6c91-434a-9fb0-32e457fa482b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "7620b547-dd6c-4e7b-8232-4f7b16b1afd6", "value": "3de3efb60114bd192d2454a66f8089403dc2736379bccabb5cdac86e4ec702c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb13a5c-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "8a85ef3e-bb13-4661-bd2f-8bbc54fd107a", "comment": "Malware payload (RemcosRAT)", "value": "ec6fa8fa986e0217167226bc3e83129a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "bf251d09-0916-4572-9aa7-8e3310b9851a", "comment": "Malware payload (RemcosRAT)", "value": "3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "019bd380-80ef-47a5-93c9-97671011ce48", "comment": "Malware payload (RemcosRAT)", "value": "4ccd8e8893cca38d86056bcb53c9ba3bd8caf422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "2f50bb5d-6cc8-4b31-80ca-676d5d1a90f8", "comment": "Malware payload (RemcosRAT)", "value": "43e8b8262b66c4d5ac66e720ba7b66b7682ca3568196ed7989b5abb5c3343180266136959983c82e88487836c207fd53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "af4237fa-4572-4fb7-b61e-5ae05a2685e7", "value": "T1E64523942B604722EA3B5BF80436D17243B51DADEA31D35A1FDE6CDF3A87720486172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "f48a24f8-1307-4a48-95f0-eadeba26e35e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "a97e5aff-1831-48ec-9cda-e6c6d1356833", "value": "24576:MNesHAPJHFt5JKsxjihm6VUYenPN3ud520bEQwoAxu6CB:qnARn5Esx6zVRePN3g5B/bAxtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373924, "uuid": "5952ee43-5869-4dae-b3ba-32f375387441", "value": 1272832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373924, "uuid": "5882af5d-6dd0-48fa-8930-6583bc28300b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "69941136-e875-4968-8b95-d67d41fadd8b", "value": "3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42106466-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "79f3d6e2-88e0-427e-8c2a-a64c9590648b", "comment": "Malware payload (AgentTesla)", "value": "6772cbf8d7b955a15c50527469d6c213", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "c787957f-9501-45aa-90c9-34f605bac46a", "comment": "Malware payload (AgentTesla)", "value": "3f082f15d30f7d14127e9235c2cd0d5c231cff9aa31970c31eb05c6cf6076b8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "42ec2dc4-33da-4178-9b90-237feb1fa315", "comment": "Malware payload (AgentTesla)", "value": "7a32627c5fe0c9795fc536f1c493fe984a3a3c05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "ae54d4e7-f220-4af4-86a7-2556c2739e2b", "comment": "Malware payload (AgentTesla)", "value": "7451b460718135b320abea8f3ed355230121dafee1e9b125bc4deb972bc9ff3317f56070a451ed42e3a89663fa0123e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "d4746729-ae24-4285-b92e-2cd03238d8fd", "value": "T1D555CF983212B88EC487CA72DCA4DD7462506DAF6797C20355D73FABB93D6839F140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "f8c048dc-b214-49f2-9381-3e1d334eb401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "a3e06945-0f11-4ff0-9e55-d1a97ea1c543", "value": "24576:lep50Prvg5+6lQL+hgNOK8pkEKTb1VBtKP/STWhY:spWuFiQgIPUXum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372754, "uuid": "8166b5c6-355a-49dc-a8d1-9b600bd8576a", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372754, "uuid": "12d3b0a7-f8f4-4050-9625-c376d7500f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "907f1795-18a0-4941-b195-216d7b260291", "value": "3f082f15d30f7d14127e9235c2cd0d5c231cff9aa31970c31eb05c6cf6076b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25a8a5b-950f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786403007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "2e6aa824-c44b-4710-80ec-927d69528eb5", "comment": "Malware payload", "value": "2ca1a863f6a115127d623d3d181ab9b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "c3113d94-b07e-4b5b-851c-5f8290b0cc63", "comment": "Malware payload", "value": "3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "c31a5c10-5e12-4c17-94fe-91432f57f5e2", "comment": "Malware payload", "value": "58c15d76520685b6c151cd48b09375bb94b825be", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "56723254-ff7e-4994-bd7b-c6664ab969ad", "comment": "Malware payload", "value": "cdd8c85c79ae614e7cbd464d3a427ae2a1e818378a5a7845895c14abeaef283e15fbff2b42c1175d78239a98e23740d6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403007, "uuid": "71749992-5488-46ba-afdd-61212b3273d5", "value": "T1AB21BE8EABA1ED3120D9D528B7F2493E5E62F29A2C107411358631FCE4DC62032EDC7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403007, "uuid": "2364d744-e500-4adc-a477-4665d2349eb7", "value": "24:M1jvF3SbinrGx1wyx1eC2uK6MTzaH+2TMTSIAvF2b2m2p4nKTNXT5eORv:KSbinrS1wO1F2uK6MTu+2TMTSIfy3dAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786403007, "uuid": "1d50c83e-e455-4fa5-998d-dc1d2c1225a0", "value": 1157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786403007, "uuid": "5ed77c21-4fc5-4545-9bf7-1ff0f792d84c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403007, "uuid": "bfbbe26f-16fe-4be9-80b5-5d299a74f1b6", "value": "3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509078de-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "ac720068-42fb-4a61-8182-4a130babdbe9", "comment": "Malware payload", "value": "86bb26cd21214a1d9c4f22871ee4f9be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "2b7ebb66-7ead-42df-aa12-0246bcb1a802", "comment": "Malware payload", "value": "3f92691679255d80261e1574ff177ac0dc88de66fb1b3dc08023a85ac4e389fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "86d4bcdc-1a4c-4829-b219-aaea1531adab", "comment": "Malware payload", "value": "5518360819b6d30af0c0f892a96f42cf09e7ebe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "357097ef-9c8e-466d-b171-a0f2cfc16df1", "comment": "Malware payload", "value": "f008d8662d1d3576a776b77f1021a60d5d5359ed3c5059d506712e7c6dd9339047e0fca6863f9822ffb2c63573d9b76f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394682, "uuid": "f4e0e0dc-51ab-4da2-b092-da398b135bec", "value": "T171D33B17FB0C0562C8C36DF80E3F07E683249D5220FED615651D7EAA1B32E719687B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394682, "uuid": "431e77a1-a1b9-4b31-83e3-e29404f3d159", "value": "3072:/3s4Dn8p2Xg3yVaFOT+cyA9egTQNt5sz8MaPUqu:/s4Dne2XVVaFOT+cyA4tmz8wR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394682, "uuid": "6857d518-c7be-4952-ba09-8ba558aca580", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394682, "uuid": "113c73f0-a479-442c-a857-2a8e8f809ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394682, "uuid": "3e4109d2-c88a-4a85-8c90-c7b9941a8f9d", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08152d0-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "51369c7f-e10d-4b7c-bb8a-ee2041276584", "comment": "Malware payload", "value": "b57e721c9b1ca921b911c74aeb4aad09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "42be1b0b-f5b4-4fc7-a91b-91bb6f475094", "comment": "Malware payload", "value": "401b42c6795e9103e4eb4eb6647fe49d7b225701fc0ff372e5508cd8c291e093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "4092915c-2785-487d-abd4-c0a880811522", "comment": "Malware payload", "value": "9567e85551c25538fac2bd8ecde88a4096178983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "b77f714f-27b6-4c3e-a46b-c5c1e611504a", "comment": "Malware payload", "value": "69a905c66c1ea227b91a6e615ff7aa710e1b9bee7c01094c21c2c306870fd034dcebb4ba2b5ea1e7157adcd67180837b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "42a4546f-beb8-4015-b061-ddbce3006aa3", "value": "T15D83E1B3F2E66C80C6AE32741453F8D110BAD44BEF379BB996CC18896F01714EB61B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "215a97a1-4df1-4ed0-82d8-a2efb165dc29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "926eb0f5-7dbf-487d-8745-a1465ffb7570", "value": "1536:47beYhvSVxoOmKhkAjokUTt+804/7NZ1qQXp/tPkM3tsoGDPud2qDD7j7OaTeTk:47bDUVxoOZhDjtgb/7NZwkp/tPd9n/D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368215, "uuid": "066026da-869a-42d5-992e-57862502c01d", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368215, "uuid": "bc43c050-e04a-4e35-acf8-201292b2bbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "604f06bc-4795-4a81-b207-396ee9365cea", "value": "401b42c6795e9103e4eb4eb6647fe49d7b225701fc0ff372e5508cd8c291e093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0c56db-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "2624c095-e692-494a-8fcf-4153877ffd00", "comment": "Malware payload", "value": "59c149a9e2e27f4c672cb32f0fa01d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "f8355254-4a3f-467b-a775-7ef2bf1f5f86", "comment": "Malware payload", "value": "40273c04c5176e7867cf29f34fb6e33182027b66e8de8fa449fb5efb5c0d2dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "3d89e07e-624b-4b50-9043-1e4fbfa0023a", "comment": "Malware payload", "value": "e3f4c8edc09dbde67555ce631b4ecb1c4630d9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "3e144622-3c0e-44a7-96b1-ece8b4945c50", "comment": "Malware payload", "value": "9c00c65322b709e77c45a390649ae406b96acb64c17a9096d37c1d06e648545f66b93ac07d1db7dcbc4022b6f550de81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "7950adaf-1689-402d-be1c-f5131a4b1c70", "value": "T10D75F1112DC32264C76B0B34C129449C67F49E4742D5E6AE2EE962FFDAF274EC8160B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "be58066c-97a6-4bcf-be3f-95fae9894992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "bea57529-edd1-4d37-b001-05a8d4869757", "value": "24576:eVClKm1Z/rM655yJmg6K4lZGwo9usMAPz8C2vNOFQ+VH:eVCvZ46OJmg94PGWxFSQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371108, "uuid": "70437567-4000-45be-88f7-cdfac346de26", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371108, "uuid": "2d260001-4689-4804-bb6a-80c2d83d2d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "511d642e-5a0c-46c6-94e5-bdebe0892f0b", "value": "40273c04c5176e7867cf29f34fb6e33182027b66e8de8fa449fb5efb5c0d2dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6505872f-94f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786389563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "8aed21c2-7a55-4b6b-ac48-41b1bc23f218", "comment": "Malware payload (Mirai)", "value": "517aae584c84ae62f9ceac831db6e2cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "2fce3b7a-0fa6-4686-ba34-ced860adc199", "comment": "Malware payload (Mirai)", "value": "406d2eb4deac2f4577ab528be46b78f90a87c7e5b08b070172dedda263999cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "43caae11-a136-42a9-99dd-f475e1a47c13", "comment": "Malware payload (Mirai)", "value": "7408213e335f66494564101c4bbd709dc4eb0276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "72e684bf-b6af-430d-87ac-80b93074566c", "comment": "Malware payload (Mirai)", "value": "3185a1d9277d8fdf4888bed0cd01e1ebcf148f14724436d5a5f4546cec2adba843023bccd16522686bc7f6b5913ef1b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389563, "uuid": "67721fce-ce96-4edf-b991-d8e7194c1e56", "value": "T13BD34AA3CC2A6F5CC224E5B4B0B49F795B539921808B6FBE1577C2748083D8DF6493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389563, "uuid": "779ab5b7-8ce7-4877-971c-2218130b2c42", "value": "3072:f/ysKkgV5nqVTccn0jM1JaZeiN4W2ZW/k6TseHz/:XyHtV5qVTccnj4h2Zy4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389563, "uuid": "fbecf871-a6fc-4be9-be2e-b29e96a4c267", "value": 130296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389563, "uuid": "7195afc3-48ae-4500-988f-34104a31ed9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389563, "uuid": "93659d00-a2af-461a-ba65-87928fee052a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4e42cc-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "ae95b4d4-0860-47db-bc94-60f458d135ba", "comment": "Malware payload (Formbook)", "value": "b795dc02fab37a4f0ff448f7cea827bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "63c22a9d-0935-495c-9992-c72ab675ab98", "comment": "Malware payload (Formbook)", "value": "4093e8851281fe4ae5074a27e5e5c4906e31440aa5875b55403bb3d5cf096199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "6ea02e2f-f779-4a83-a98e-28622062d4bb", "comment": "Malware payload (Formbook)", "value": "cf08feecadde7056e9a8f331c79d095919d9bfb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "833a6d54-360c-4167-b75c-4c2c70981607", "comment": "Malware payload (Formbook)", "value": "994d533f77845febecec469875f8b0f482995f94d97aafc70228de8c6436eec15bd1350ac6e10c19e57d780af80bdc7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "2887e8e6-bb6e-42c6-805c-41dceb1e09c0", "value": "T1A335010022A5CE06D1BB1BB02DB1D27057B87E96E962D3074EF6ACFB7D7A7121815393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "bd885d45-1b48-4db6-999c-561a8fdb3bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "8dbca5d9-849c-446a-90c5-6d04d92902f9", "value": "24576:vNZkYeJa8OxH1yJEvo56ahZPLeit8W+sdPpZqmR7HapEfRL:VZgIaDHt8WpH/xa2fRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369150, "uuid": "90c6b08f-b454-4376-813f-02757b0c4836", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369150, "uuid": "09f953bd-21a3-4d25-80b2-17736a7013ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "534686d0-c67e-4644-8a21-2d3aa21c636e", "value": "4093e8851281fe4ae5074a27e5e5c4906e31440aa5875b55403bb3d5cf096199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805c1016-9486-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786344082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "475b4e85-0184-4c61-baf4-d74f991e54c3", "comment": "Malware payload (Mirai)", "value": "125fb6fa9abce626be03ab346cdc146f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "2cffd4e0-5175-40c0-9f3c-e01e4663b0b9", "comment": "Malware payload (Mirai)", "value": "40a9190f3f5a0f86f97065f09d071b5622517729b6b81442afdc408ae8ec9330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "ed172064-8dec-46fb-b6d5-3dbeb1bb43d5", "comment": "Malware payload (Mirai)", "value": "a9930517def979ee28e30ba1095b3335c476134f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "b091f16d-72ec-4524-a391-b739f89030bc", "comment": "Malware payload (Mirai)", "value": "a277b6f9cc5be9cbb33213533a8c901d1cd09ba60d385fe697d90d6b3f99227e8a7e5bb4f1dd2438345e4fb2e31861db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344082, "uuid": "743214a1-1cc0-4763-a8b0-d172ab39c5c2", "value": "T1C4031B46EA519B09C6D272BEFB8E014E37176FA8E3ED32359E306FE013825E70935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344082, "uuid": "138d3479-2a7b-455f-b522-ecfef8c45d53", "value": "768:MknfZ7W0BFWJpzunYeNLDvm9pJ5M8Leio6hg+wd9SaVjH9yh:Mknf9VBFWJpSY2SjDMTio6e+wdR9yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344082, "uuid": "bd127279-3d78-4a1a-93bf-a53f6e237f90", "value": 41128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344082, "uuid": "b4cde124-0169-418c-b6ff-de65cef63dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344082, "uuid": "1d148731-f24f-4276-8c73-8154691ba312", "value": "main.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961efe3d-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "1da3cd38-b848-4f04-b834-340f5a6c8bd6", "comment": "Malware payload (Formbook)", "value": "670907efc31b8887b15784879d7f50be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "e496c3fe-03cd-4ad1-84d6-991c1d6e8768", "comment": "Malware payload (Formbook)", "value": "411c1c6c545c60db98816e9c73cc7232332688fdd83a10958120f5d8ecacddcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "c5ed25e2-313d-40dd-af77-d772a513309d", "comment": "Malware payload (Formbook)", "value": "e9f63e64b4886277b135f2e59e38377d86fd9d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "742fc433-33b5-489b-8afa-fee342276bf4", "comment": "Malware payload (Formbook)", "value": "a615ebc5157664da47f5bcfb722ecbe648572a41b8b499a53cbadd8c065a88d704eb1df7d35de6eb20100fa70ca13682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "a9adc813-d892-45d4-b35d-b972558c3587", "value": "T198D402284BA4DE15D1FF67BCE069490443B59187AA87F38A0BC9B4E32C3B325CD455AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "fc04a029-3071-41d6-b91a-6b09372ded12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "74889627-2657-4add-815b-a402916ac036", "value": "12288:5Id97yIGbDWCrnY7SN7obxxucLXl4voy22:5IdhyIY9CFmcLVWoj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368170, "uuid": "729d0ee4-ea92-4fae-a86d-e7f9a256c342", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368170, "uuid": "6ee6bdc7-25d3-4e44-a3f6-b87e422f6490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "9858d6a5-4435-441f-8359-204d2cc61b60", "value": "411c1c6c545c60db98816e9c73cc7232332688fdd83a10958120f5d8ecacddcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bb17e8-94d2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786376793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "b552e587-7d1f-48fe-a6f0-93cdaa609bb6", "comment": "Malware payload", "value": "ad73efed9af505413cf3f11ec0174488", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "a48f46ec-e5ce-4d3e-874c-20ea5cd99d64", "comment": "Malware payload", "value": "4127e9f40372f891de46f404ad4662a88ab147bdda43b0dfd6bcba0a929f84e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "772d2222-8846-4eb6-bdd9-66413ccbfd52", "comment": "Malware payload", "value": "f5c2b72272ff30ef25d95dd4bf1c844e27ebbd75", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "52812b3f-3fb5-4e5b-8f49-9bbc5e7e2248", "comment": "Malware payload", "value": "670d8bf6eb343b1dea23e35f0cfef0a7320aaea5c56aba1b63b5b04fc56caef6545851209c678050fb382740f28b798d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376793, "uuid": "8105843b-97f1-4ea7-b993-71d7446074e5", "value": "T1BB575D224111FA0AEBCA4893D3CC649D17BEE85316F923D14547FB99EDAEC1044BE3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376793, "uuid": "6a8c7b51-3ccb-47ef-9272-671acfa8f2d5", "value": "768:Rf/ZvrErEKOvsSbAvhItv1RJPkKhX8rXuANpwC5vhNnXfOHqPoNl7Lf4DRWN6i3S:jlfZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786376793, "uuid": "6818a23a-0ee5-41d1-8a54-377df8fe3812", "value": 27690102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786376793, "uuid": "8bfe4cb8-7a48-4495-b298-0e5cf8bf5810", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376793, "uuid": "55c5c74c-3a45-45cd-b1c4-e368990f16de", "value": "Wire Transfer Confirmation slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8c76e5-94fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786394380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "3c2594d8-bb19-480e-b83d-6442101fa84e", "comment": "Malware payload (Mirai)", "value": "c66302477fb7660aa4a48c9b7d6ec132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "b3779acd-0827-4278-a179-6fe2039bff16", "comment": "Malware payload (Mirai)", "value": "414e58a1daed34a76d0c8da692db46031e22724d7b60ecb623b65938ede79e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "5227abc6-10b3-4e61-8167-8c6a4cce0422", "comment": "Malware payload (Mirai)", "value": "71fcbe007e6eec2fa6014a2970aad6c55df09481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "edd54d48-e6f4-4beb-95f7-c93d9778c9bb", "comment": "Malware payload (Mirai)", "value": "d3f3691e5534ce4e2edd17bd54761288184d5f5c2854360269cd405dae643ed8c312f48ed65368c22a5081443b85ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394380, "uuid": "900bed55-b788-4f83-8097-04b6f6573ad9", "value": "T15BF31956F8819F11D5C115BAFE0E128E73131B78E3DE72129D286B747B8A8BF0E3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394380, "uuid": "8db14760-4090-469d-9a00-050b23bf43d7", "value": "3072:SkY+oyPBiE9FQZtT+4t9FJVaBJwXmDyOWPkfxMrv+ioNZYHT:SkY+oyJiA+tBt9F/ajw06PQxMSiorY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394380, "uuid": "b15233b6-65eb-4dbf-95ea-a7658fdd244d", "value": 158324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394380, "uuid": "ca15b7ee-4e79-4bb3-98ae-8b8d791ab41b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394380, "uuid": "e02bbb2a-3e91-45a9-b862-449ac3dc808f", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0204cd-9505-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786398760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "42f5e0ed-6a38-461d-9c34-977c9126dbc3", "comment": "Malware payload (Stealc)", "value": "970730ca84b2c76a69ab7d7a66c44eaa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "4f5218f0-7400-4c5e-bc3c-9478b71d143d", "comment": "Malware payload (Stealc)", "value": "4153db289c9a3de57845890aadeec7951fcf5516fd39f25c6d8c3e42fc21f801", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "736f82ca-9bf6-468a-aa42-3d3b0bbd7a51", "comment": "Malware payload (Stealc)", "value": "b81060b760438d457b99b76fe250543d80433936", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "38923b9a-6638-45f0-8e48-260d095c275e", "comment": "Malware payload (Stealc)", "value": "f3387c3edcc8515477c2708ed32292648d78a6ff68a9d0d259401add1ac055ee5ca809beaafa6f1fa66fedf521fe3cdb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "ebb37de7-0101-4afc-9069-2d4edfa6177e", "value": "T1AB966B02EF8648F6C406673194A7622F6734B8180B39A7D3EE507A79AF733D15D36788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "a9aa7373-055b-4bc3-b720-5f8106771e3e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "aff1cc8d-2fcc-43ab-91f9-a389968cd303", "value": "98304:ptltWjGxwSoJ4OlSAxVD60lVEIv1IDxBaW6YK:pUjGxhfc6yQ5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786398760, "uuid": "9b187aba-d220-4409-affc-806d1cd06c51", "value": 9471344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786398760, "uuid": "bea5cbd1-e752-42b8-822e-f9ddbb5da4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "a651d0b8-7754-4874-b4a8-9e885ce65c65", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ee2695-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "5e71db0b-b9a3-4ecb-bc16-ee5c0f97c21c", "comment": "Malware payload (Mirai)", "value": "8fef12dc18195206082767f4fd15fe55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "bb6aaec1-ad0a-4f3e-ba57-60d46a20984a", "comment": "Malware payload (Mirai)", "value": "4169898705c73de32d18ff6cbabc18ab416450d4503ba51ad66e02d256e9e647", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "317f415e-672a-4d5d-8189-36dd5279aa61", "comment": "Malware payload (Mirai)", "value": "a1ec32b649bf7d81f435672039398af6d1312e16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "eb83f932-1043-47e2-9571-7f83990f1d48", "comment": "Malware payload (Mirai)", "value": "193791d3eeebd690df84dd4ae0b6bb900028a8f1cff4aa10ac873536285f290529db850b625e4eab2642d5af22f9561b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "696132c8-48c0-4ba8-a3ac-75ae01885288", "value": "T11D245CC7FC00DDBEF80FF3B6449B050DB570779518536A3663AB79ABAC3A0851922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "1efe73ff-e9e6-4c63-96c8-40827a5f5148", "value": "3072:xwyt/IKrBNWIDRe9jd8SzS6yPztSEo11T6feZNugV7jbiQLrNRzGEYF12KPu:bt/LZsJ8S7yP5SEo196sNuULq/2KPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356839, "uuid": "623d1aad-7135-4c73-b734-3b1220a845b2", "value": 218168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356839, "uuid": "f3f8c1ce-ef9e-48c5-993a-d32269ad3c3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "49a85e61-5447-4fd2-acb7-dd1bb9284326", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69e843d-94ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786388411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "be8531e5-5be8-4d97-a4a3-44dde1acbb89", "comment": "Malware payload (RemcosRAT)", "value": "94ce668e58646c3189fafc6820c52424", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "f1cf33ce-881e-47db-8841-64274fd01d00", "comment": "Malware payload (RemcosRAT)", "value": "41a89f7aa20f39090bdae154194aa5108f222a654d0da8f56f98f6e8be86479e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "578fff52-8895-4843-aa69-fd3cf52514e0", "comment": "Malware payload (RemcosRAT)", "value": "85f316eca730a1acf5457f37aff5486b6a3a6ae6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "39e85e7d-14a2-40dc-b54f-037672c7f7c8", "comment": "Malware payload (RemcosRAT)", "value": "61c76b11e7755eb87a01383d082d6bb097d9b0ae6268f6ebd8c48651486e5f79688b3d7e4085023fa6f1430b7875b0e3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388411, "uuid": "f70671f5-a9e1-45c7-8520-5b54b105407e", "value": "T1CFF6499E15E2026769528F7CBA0377DE01B9A08C43B714999DC0B7EEFF89DC694210DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388411, "uuid": "ffbf4624-d8d7-49d5-9c12-ae51b3c3ec9b", "value": "768:XNPKNCVnaX3EeruViEFcuyNWdTSVjFc5qoJa6dgTAVjEFcnJgRlh+JWvhUJGrlcb:Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786388411, "uuid": "15d7e3e1-550f-4e86-8840-57147ebc5afb", "value": 15929050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786388411, "uuid": "b1d651fa-7337-4a75-b8b9-5d6939c04668", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388411, "uuid": "71df77da-047a-49e1-ad92-4e54f6ac12c9", "value": "rCOTACAOURGENTE-CONTAINER-LISTADEUNIDADES.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409d1e71-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1786370604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "2619ef06-01ce-4d0a-bad0-b4740141b3e9", "comment": "Malware payload (AveMariaRAT)", "value": "f7292702ddc20a9f518c29f4a76cc4f4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "4b2fe0ff-aa1d-47fc-be88-3c947ae5076e", "comment": "Malware payload (AveMariaRAT)", "value": "41c42b9077367da12e73bc55fc099967e01b65004f278f2263afd4f036ec51a7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "79220233-f201-4ad4-ae41-f9a3b3ec48db", "comment": "Malware payload (AveMariaRAT)", "value": "236060f084b00479df21c58859d7ef2998b0cb85", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "0f466540-c4be-477a-8396-a76e19df9a78", "comment": "Malware payload (AveMariaRAT)", "value": "e6750c290bbfbb9b83873c825ef05b0e5da582f8c8b21d6532f2558ad6f7dedbb82b33d7e68f50271014524845cc5710", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "96d34f28-a926-4b44-9d23-47e2b6670d2d", "value": "T13794C0CAA6D04D35D94A9D34C0301E6402339F593E5AF346EE78BC7337B36E628A1997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "dca65f13-b369-4ec1-9003-18d675c52975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "ed046028-43df-4377-bbcc-88125d69ff8b", "value": "6144:XQAVoCwPBmQgT1wJkP8/QtrWTIZqKR9W8BZxFzAJqw4A/mSHCX3Yh4Iu:xoCK1dkP8SeIDtZvzh/OmSHCcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370604, "uuid": "f921a336-6cf5-4581-9eeb-e7258325db1f", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370604, "uuid": "57835e5f-663a-4136-ba02-fc3a7f5d002e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "5b083174-e0c4-45ac-8b97-b333f3d471f7", "value": "41c42b9077367da12e73bc55fc099967e01b65004f278f2263afd4f036ec51a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a822823-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "cb613a10-7cae-44b7-914f-0f90f6ab46bb", "comment": "Malware payload (VIPKeylogger)", "value": "d3f254445545f72329eb8a31376cbf85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "8ebd8e67-8f7e-41c9-aeaa-7df5e2e5c94d", "comment": "Malware payload (VIPKeylogger)", "value": "42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "029bb059-931d-4f25-972d-d7a6881441ad", "comment": "Malware payload (VIPKeylogger)", "value": "27ad0d5db4ae7b8d8ac2fe7937a6d5f8a1b9cee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "5a2f2297-100e-472a-8bf0-3aafce978ad6", "comment": "Malware payload (VIPKeylogger)", "value": "4d921d88c0471bb07e5ce18798006996fd92d35b8cfba3932f54e44e906e0a8d6fd96969abb6e2c8dec0d28a19fef0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "74f8f728-4a5b-4c08-b5df-57695deb73a9", "value": "T16FA30122A37852A1C4FD87721B732354CA74BEC15823EE7F3BF5708E7A1A2985141F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "4415113c-ab72-4229-b39e-d5de2391b9db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "dab8e5f7-8918-405c-ae9a-5c5d9545e3bf", "value": "1536:/N6ERbGQUgUoapFKZ10X+y/zWMwLQ/A1o8h5z+UKhXwaQldrd0bJrPq7S7G:/N6ER6eUoabKzWh/aMwAQz+rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373681, "uuid": "d537ab91-8d54-4e2f-8152-9c91d874e3c9", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373681, "uuid": "b7280417-a0a4-4186-98cf-dd788b16b472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "12544fee-14e5-46f7-83b8-8b0a63f9d687", "value": "42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e74c929-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "04655f02-cb76-400a-9c28-568e55051e22", "comment": "Malware payload", "value": "ca4edd7d2ebb11d8e880628981f024ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "a0a0e39b-6296-472f-9e62-a60ff03ab39a", "comment": "Malware payload", "value": "42597a1c5eec0da6122881ce08f2ffae4d3a38400f3c158ae789c6202e201d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "0e52395b-7899-45f9-b46f-f770f48fd732", "comment": "Malware payload", "value": "a5b763adb359e7d44ffacc05f6fef8b8ca01525f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "8c690fe4-9530-4e60-bcac-c45f5d44a6ad", "comment": "Malware payload", "value": "302d64d102a7b72f17adbef219174bdae6cfde8d37204f89edb81ed28bd98c54f47eb6663e157676d0c748967042ad44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "a0d36b5c-3c9f-4708-88a8-463a82c76e1b", "value": "T10CF7338083494615D1CBAFF9226F1FE3AE275DE0A269E0EF47A38471F4D5866C58C18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "63064ea9-2e87-4de2-9ccc-bf3172ece5d1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "27f6104f-1e50-4e73-ae1a-7cafd8c6a3a6", "value": "1572864:BLdkSDxh4UluFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB767:B21guaABZVPArg/bXeB767", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372828, "uuid": "288aed3a-7ad3-445d-b2d6-b5f0f10e8bae", "value": 72821556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372828, "uuid": "b7ef531f-0397-4716-9bc1-3f7ff434cdcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "07da628c-a41d-4961-861d-11668fb8c367", "value": "42597a1c5eec0da6122881ce08f2ffae4d3a38400f3c158ae789c6202e201d8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75745248-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "c8faaa66-4746-4c4f-903a-2f2225508c06", "comment": "Malware payload (Mirai)", "value": "c4caa4cdf250efdb8ecfa67330df68f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "40341c5c-78b8-4815-be7c-fa519a88beae", "comment": "Malware payload (Mirai)", "value": "42632385fc419e7492bc6ea22406b93844261fb7119be9681187fd2c46612192", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "4db0ab04-0ab1-4902-a3f7-a80e92caffed", "comment": "Malware payload (Mirai)", "value": "8ca084ae179ffca8215a07cd341c13755d5fc4c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "45884a90-d459-449b-bf28-cdfd405e473f", "comment": "Malware payload (Mirai)", "value": "f087fe5b21d6f0ab875106a49144b8d2a26bd12e98817c0f4b5562c5eb28ead5e46a355bb3f4728b267899b8695aeb06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356949, "uuid": "46d86a6d-b079-449c-8cc5-8e3227aa82a6", "value": "T1CF146C16B98080FFC496D1781BFEF43AE931B0AE5278725B27D49F262E4DE615B2C740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356949, "uuid": "6ef7ca57-bfa8-4566-a90a-92fe0331380e", "value": "3072:G+wyfortJ8WzCKbh8O5BrJfUAGYAQCznl9Y6vyA1vWzJUU04Q7obj:DwCortJvzCMtmfXv+OTlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356949, "uuid": "850a18e9-8346-4445-a8b9-49ed9ac59c2d", "value": 207528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356949, "uuid": "81a9fba1-4eea-46bf-ae48-b569d5938dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356949, "uuid": "a11a6347-0955-4587-9687-2afbc2335e81", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3229314-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786370823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "9d53d6f8-e0b9-4211-ba42-5cebc70b12bf", "comment": "Malware payload (AsyncRAT)", "value": "8284465df87cda31b4bca24429fc15c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "4391c404-8d52-4167-9e5b-91227d8c1b65", "comment": "Malware payload (AsyncRAT)", "value": "428e478e4fd72979677f7fc4f568a2fd05a811cb3ff555a4bd068226e86b012f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "ae031f54-f08d-41b0-8e2b-a2d7c728dc22", "comment": "Malware payload (AsyncRAT)", "value": "b0fca726c690270381f9f48acc0ffe36cc762a9e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "6156a659-2a30-4ff4-bf47-993303848286", "comment": "Malware payload (AsyncRAT)", "value": "17794ce7da395220f190e75db33d6bb920c45c1ce72ba7fc51b253bffd6441a4aef3a4b80881e57d3b53e2f6119cd45d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "1b2577c7-ce2f-4fd6-8977-88c7bf7f0535", "value": "T1D8050288335BCC02C5A25FF01EB0D7B4157D4D95A811E313DEFABDABB4BE29A6C85181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "d143d42a-0e9d-4180-a28e-9a7e7bd64c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "25abcdfe-9afe-41f8-a0dc-de137110bf98", "value": "12288:ko0/fJ6L9FOdMp+0ZO+l8fHJZnPwX9iB1gcHwxo0ROQ5n5hstWCJ3t479KFhVgUV:kFR6pF3l8fpZn4X8/gcQewdCn6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370823, "uuid": "a2be9a81-69fa-4fcb-bcbb-dc27f4675f8b", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370823, "uuid": "15686ac3-6d7a-44c0-890e-19f1b47f63f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "721cd383-af6e-41ca-bddb-4a31cc6bdada", "value": "428e478e4fd72979677f7fc4f568a2fd05a811cb3ff555a4bd068226e86b012f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c8a628-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "9aee84b2-cb00-4960-aa31-de944903eb16", "comment": "Malware payload (AgentTesla)", "value": "7826b02a5d73b2bd4c761a7da83eab3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "6dae2902-7708-40cd-9ef4-ecd4b04671d7", "comment": "Malware payload (AgentTesla)", "value": "438313337a4f7fa20ce65036e4df4efc7c74065c419ceb6c7041bb4590842f5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "3d07fb51-572d-4a0b-bd1c-f1e6fdd4eef7", "comment": "Malware payload (AgentTesla)", "value": "810a9de3273e62285b124d5d62f26b75062afa29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "b9d179cb-3411-489d-b7ce-026125ccbbf9", "comment": "Malware payload (AgentTesla)", "value": "e4d05b360ddb7d6dc1fbbb6d55f49746799c9b9da40ea7536fe5a9c0f30597fd04c63d5ab4102dadd0ff14e0540f05c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "4c701221-6299-46e5-85bd-636364edc232", "value": "T154351258330ADD02C9A16FF01E70E3F415B94E88A411F3538DEABE9BB86E69A7C551D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "55b344e8-155d-4248-8954-ab2331e5c160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "28845ff1-920d-46af-80ae-f3b1a956184c", "value": "24576:8UR6pFX5pgKvk1Mp4cQJPmgXWKRBvpwB495P5VCbZAa4yYmgNJ:8cih5Sh2eTJvpcY5PHCbZnYmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370888, "uuid": "1fd78f1d-c919-446f-9f03-6b28943dfca4", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370888, "uuid": "fbd550e2-700a-405e-a119-aab33c3b7878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "27e16ae1-9920-4524-98c8-de89237c70b0", "value": "438313337a4f7fa20ce65036e4df4efc7c74065c419ceb6c7041bb4590842f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b0e148-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "85bc1c7f-4851-49d4-a05e-9531ac3f9b54", "comment": "Malware payload (AgentTesla)", "value": "cb504dba59bd2d2d3fa003fb28e1de7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "824a85ee-62f8-43d4-9884-7437d3a8414f", "comment": "Malware payload (AgentTesla)", "value": "43b56732c17a9e385314f01b5c2dcf488d0d401c0dab276efa8bcce6cd19569b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "1950cb74-dfff-4daa-89c1-9655a110503a", "comment": "Malware payload (AgentTesla)", "value": "ed4cb261669def78c69c3c5cc3a4dfbcad1f28fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "d3b177cb-9696-4af7-ac59-f4a3bc23ca22", "comment": "Malware payload (AgentTesla)", "value": "25db7ae296454e4f817add542d2e967c40d99213d7058dffa5aa0c3604e85304f0c0a347b52af8551af64dd1d4733cf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "6eeea328-4e90-4a1c-80e8-755d23452cbd", "value": "T1E32513586B07D503C50167354AE0F2B416AD2FCDED02C217ABDC6EAFBB66F5A8C841D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "3b5033f8-b551-4397-ab3b-0196aeaf911c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "9a82a4d8-0763-476f-8fc4-82345bb867a6", "value": "24576:Km+H8Uc8vCso4OIFSORh4gNGt2dPVZpe:KF5/Cs1RhS29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371896, "uuid": "8338590f-8572-4c90-88f3-51c387e11631", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371896, "uuid": "a9dd0376-53d6-4590-82e3-6d1494fe2392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "ebf0930c-fe30-4aab-9daf-dd0104e5d9df", "value": "43b56732c17a9e385314f01b5c2dcf488d0d401c0dab276efa8bcce6cd19569b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f85a06-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "922626c9-5603-450b-a36e-612055210e8a", "comment": "Malware payload (Formbook)", "value": "617775fa6174879d383c99c6174532c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "78ca9490-1255-456d-9f2d-1923504a02d4", "comment": "Malware payload (Formbook)", "value": "43dbea10a7c69096dbc8dd3bf31f982e4927f58b02b4be3c3d26432e5ff7c523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "e9902b18-78d1-4bb8-b42d-61b6981117d0", "comment": "Malware payload (Formbook)", "value": "c5ad272cea6147b686fd90f5ba8b486c40081137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "8bd66f65-53e1-429d-b638-dbde64550f3e", "comment": "Malware payload (Formbook)", "value": "333015679839bb674b1398bfa8c31db57fc95d64f2cfee57c2f9edc0f4538c839c3284e183ecf885afe10c95ce35fa2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "335dc549-c66e-4b3e-ad0c-a1e8a8e3e2df", "value": "T1243501C03769B706DEB916349A38EEB547F92D65B420F5AA1ED83BCBB46C6015D0CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "f4415878-8df3-4646-92bd-6795b762cf6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "fa29cc95-f4f1-42b9-9b38-0f9e95008ebb", "value": "24576:lRflJgZ83IgNMfrswFEOd85bhqUZmj34a:3flJ0uNMfrEOCth63P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368496, "uuid": "b33726a4-a911-4b0b-aa09-d3dc739b35d0", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368496, "uuid": "34de4f1e-40b2-486d-8fa6-e53bbc6a2e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "28d994de-7cba-4518-a070-ba4e2e978fdb", "value": "43dbea10a7c69096dbc8dd3bf31f982e4927f58b02b4be3c3d26432e5ff7c523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771eef2b-9470-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "3ca8e5df-c446-4fc5-b8ad-8636fd440bb9", "comment": "Malware payload", "value": "c34723deb13556101c52cc85acecd684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "364d33ff-3002-4c59-b7a6-8f23afb6250b", "comment": "Malware payload", "value": "449c83819dfb00b12f8c0af99439df067baf94ba53642c153351b8b95f8569e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "b2555fad-9d0b-4f9d-a700-31e5eba0436a", "comment": "Malware payload", "value": "af2d3ea52d31b51d3570cea735c2b5e2e0c4605c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "57da08d9-def4-44d7-a90b-f9d8e5167add", "comment": "Malware payload", "value": "2296d971d774d9f2eb5db40e695cd40cac18979d6fbc404f49b8c7ad6f9bf7130421b5fcfba1d4913aa60346640e4673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334618, "uuid": "3b290856-afc0-44fc-a3d1-3bcbb52d5fab", "value": "T134138C51B21EFECBE035993EC24385597F34AEF1B6439622F1827952517F0A31E8ED0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334618, "uuid": "6bca4982-4e9c-45a0-b039-c39f984456a3", "value": "768:OZYcSHROcK7w6TZfjI8BQDze3G3s3nMQAWeUU2ebbOz7+b43TO:BcI6T8ggzva7+bK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334618, "uuid": "77502682-3066-464c-8e01-6e4eb73993da", "value": 41604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334618, "uuid": "805046bb-2eab-4a6c-a29b-3e9124ea96bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334618, "uuid": "fe3f2f79-1aee-4546-8ca5-1d64cf76f1b0", "value": "449c83819dfb00b12f8c0af99439df067baf94ba53642c153351b8b95f8569e9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afac2854-94b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786366066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "fd98ef20-a147-4890-aeb5-80f32d095917", "comment": "Malware payload (RemcosRAT)", "value": "60b8360762c64e5cdb0b242bddea5ef0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "f6ee5e32-3310-482e-b283-7707b5042858", "comment": "Malware payload (RemcosRAT)", "value": "44dc51cfef9b16a81483021acf6f5876a9795477ee6ad5c56cc0dbbc9ce5e373", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "b1ca701e-54f0-47d3-972c-408b8921e417", "comment": "Malware payload (RemcosRAT)", "value": "55270c40fb96ff3351513bc72fb8b8b37827fd0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "068eb5ac-49ec-4515-b045-d125c47658c4", "comment": "Malware payload (RemcosRAT)", "value": "b5d9aaf0f87adecd91be55789965b6091771de04c3e006edecd10a790298717e59aaef5d30fedae3c523dcaf4acf26a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366066, "uuid": "e2d4fe4f-542b-4491-8bad-16a02fa563e7", "value": "T125475E9C5375CEDBE6A6F0FB5C03E1D206459AC70866D3086CA7E8E0D94C1B6AC619FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366066, "uuid": "2c2e63ab-37f6-440e-ac9f-0fa4cd6f25c2", "value": "1536:uKc5l2U9HsRlySalGl/WF8dARYs1imsbC6YsW3+1zB5FEzXhTibChckLj0Jm/Nj8:PqNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366066, "uuid": "8fd5053d-cbfb-481b-a4bf-2edb230ac80f", "value": 26017174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366066, "uuid": "a53c9dcc-c28f-43a6-8fae-97cc2449e7df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366066, "uuid": "68ef1c25-e179-4666-b4db-d60df7ad64a9", "value": "New Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ad2119-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "96209f31-83f5-4625-adb8-c65547a956a6", "comment": "Malware payload (Formbook)", "value": "10ca66558bc4b2e256306b05d12d3d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "a3a8a955-b1f2-4f22-af56-6a63e7beedbf", "comment": "Malware payload (Formbook)", "value": "44e551147a3b07befc6a5d110a0edbcb61d840b8fea21c9afb3998f1ccfef469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "191f32a2-9637-42f6-b7c3-a5089d6420bf", "comment": "Malware payload (Formbook)", "value": "21ac3002ad67f43cd29b3aed0d3015bfcd643aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "715aa9e9-89cd-4ba9-a27e-0ab6f8226ac6", "comment": "Malware payload (Formbook)", "value": "cff8e6db09147105c6d2c6d97c801cdc26626c61b18d28c4b408f72c073cb9cea36fdadb3591812bf1d60cfa737a06d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "539a8423-d872-49d0-9b72-e9e977e37b3a", "value": "T14C3501142216DD81D4D68BFAB871D33833B94DCE75D2D3928FE62FEBB91A3D01458292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "0d4caa78-6504-4345-8810-cfdeb721bdaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "3660d877-66c9-4ad7-8724-f83e61743ef8", "value": "24576:0Np/WIoSQaMvFShGtW/yX5jxQbrx30lCXMNJ723WrpBp50:Ua2MdSkk+5utklCXM723Wrrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372891, "uuid": "3e466a2b-a349-42c2-92f9-c043e525fd88", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372891, "uuid": "4dbad496-24fc-43d1-a3a9-6e94054f222a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "b5ca86f6-5c46-49d7-8824-e90eae1a606a", "value": "44e551147a3b07befc6a5d110a0edbcb61d840b8fea21c9afb3998f1ccfef469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf0edcc-948f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "8a87876d-9367-4e2e-b713-99b32f9c85a2", "comment": "Malware payload", "value": "ef0358b6158b65c0527385367cd60877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "74deec19-108a-4ef3-a1db-516db7e63798", "comment": "Malware payload", "value": "454272adadd78a6cc32d964244c35c4c2ba39cc6d29798e88a92e529e716c0c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "95bade9a-f05f-40b0-95ae-f29dd721b28e", "comment": "Malware payload", "value": "855e97c714fdb4dd2787092e12f31c18b4bc2d46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "5511e76b-c9ca-4463-809b-42abc67a9f2e", "comment": "Malware payload", "value": "8c8c0400ad1e0218aa075f610c04b9139a2d4498459de5908e5f68dc335bcf7530489e47b49a9eb2bfe98465c4c7af13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348074, "uuid": "f99da454-f35c-4fa8-85b4-ff7f79c03438", "value": "T13C23D627B6A3B47CC247C1785A9AD9F1B831BCE402213E3F97C9FA312D34D116A59A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348074, "uuid": "db00df52-8549-4ca9-b8f9-a6eec9d29c6e", "value": "768:n67zoHkjU34mQtGqKFczZRXVcolZZ4dvQuBvlljVJ:6foHkjWiHucFcuZZ4dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348074, "uuid": "056ee829-0226-4505-891e-d79b4e6999e4", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348074, "uuid": "db2c4549-3dcb-4a60-9ec7-a2f078c6839a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348074, "uuid": "59d19d40-bada-4ead-959e-6ca092fbb9d3", "value": "main.x86-64-v3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75716a23-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "43dacc4f-92b6-4f23-9c75-69c44fd6b9e5", "comment": "Malware payload (Formbook)", "value": "da40274f364b503f82e43425169f4999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "698487d5-194b-4a49-899a-e4d1aa293b7f", "comment": "Malware payload (Formbook)", "value": "457c5d6c20d50e70ea52ce11b6089caec01d01385a170c30e1da9c8f73de2174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "7a87023c-9e0c-487c-aa56-bd4cec31b0cc", "comment": "Malware payload (Formbook)", "value": "edf7a23adfbe866c62101affb89cac5c2e3fa396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "7d463f5d-852e-4535-87f9-8cf6640327d4", "comment": "Malware payload (Formbook)", "value": "69cb0f782012cd34fba87107700adfbc0f2f66a6559a9f9a7fbc4c344ef1586c553c7df4e5867c24bfc14bb94a647466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "c54d742a-89c8-4b0f-8f7d-2b6b19315ee6", "value": "T14D351244A6AFEE12C1B58771C8E2D0F403B21E0DD822D65B4EE9BDDB3535B468AD4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "4f131931-0923-4652-8c1b-86609feefd55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "0fda701b-c204-419e-980c-b0ec8d4db558", "value": "24576:dKwj/Og33+yVMjubQV3LN1fG8QDM4RopG1KzUuuK5U5:8CP5AVLNJGnoxUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372410, "uuid": "35d46704-63b9-4523-a804-9f6c17aa9791", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372410, "uuid": "99401312-46f3-48d0-b542-ffa885f0f2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "d8b69d51-4d6a-477c-86c0-66253f31ec91", "value": "457c5d6c20d50e70ea52ce11b6089caec01d01385a170c30e1da9c8f73de2174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f36a1c7-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "a091979f-6138-45b5-951c-35c733d35791", "comment": "Malware payload (GuLoader)", "value": "777cd2472cc4cf6794f6d99af2e4c348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "8e61df13-b2f7-4209-b647-d8662dad69b3", "comment": "Malware payload (GuLoader)", "value": "45a471113d0bd429c682d188f97a1cdd75f4f26355fd9683fbd01228a96be54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "10512b07-0dc7-4533-bf9c-1837545ab5e4", "comment": "Malware payload (GuLoader)", "value": "1528da24d801432b365fea5c41d9e6be2d440891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "e7557d8c-fef0-45ec-9244-0814781a9c98", "comment": "Malware payload (GuLoader)", "value": "539be3c00a37ca1e11b7a78ef9edd1fed0fed8002ab387d3379c1dc5d7930ccf5630f3f35661ef7d83db89675f53b91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "1371738e-d874-4d13-9a20-9a77a186f41e", "value": "T17AD402C0E7409C32D6949935CECB86A6C798765AD0B784F2FE70B95E6873D7218CBE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "0b20ab1f-17f7-4d39-adee-3c5d9442554e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "9c084bea-a670-4292-beea-d8b9993d5621", "value": "12288:FTA5RIl2R6WoAjNwBnZTs02Y43VKuEHV+nxTo8+sMX9dkmE2fJqL:FTA5RILPAjNwFZ40P4lJLO8hmE2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373313, "uuid": "9b32f6b6-4783-4650-b808-00181cdf8682", "value": 618440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373313, "uuid": "9674332f-e8b5-49c2-8a37-8c82e29b2b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "ce00a49a-a310-4924-a5a3-e47d9a4d650d", "value": "45a471113d0bd429c682d188f97a1cdd75f4f26355fd9683fbd01228a96be54b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f5a738-94f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786392307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "8e5dcae1-5ea5-4359-be66-2d5e6bc2282c", "comment": "Malware payload (NanoCore)", "value": "18599aaf4e7329d96a3c424db755c479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "0434ad80-fd71-4c7a-bec6-4396ee7649fd", "comment": "Malware payload (NanoCore)", "value": "45b98ab01e767954f09e59ec7a27cc551d6ffef6ef09559903368dc36833e26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "360e86e9-173f-49ac-8986-7a1fceec1fc6", "comment": "Malware payload (NanoCore)", "value": "971964c7ba48d3dfea6ca780590909436046ce53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "c0b14f99-8aa4-40f5-bca5-a3a0bb0a886c", "comment": "Malware payload (NanoCore)", "value": "71b723363cb3623a279fe1933164a581cc4c1d323f4cf05846e6b463bc27026e1f1658c785918b5ed45b3a911217bf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "05a3777a-d3dc-4a14-9d63-3c5cf6c2a225", "value": "T11314CF5677A84A2FE2DE867D612212169379C2E39CC3F3DE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "fecb6082-984e-465c-a1a3-120c72c26719", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "f4ec6234-0e3f-4df4-a06a-26989a9d43ba", "value": "6144:MLV6Bta6dtJmakIM5o6V2qhLyNPYTbEjE:MLV6BtpmkfM2uL4YTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392307, "uuid": "eb91bcdf-e098-4ef7-9ea7-2cf99be64b25", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392307, "uuid": "c1d5ffb1-b7c7-4ad2-8abb-a4f04830842e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "6e2d37e8-42fb-431b-b91a-dff6f1e68a9b", "value": "18599aaf4e7329d96a3c424db755c479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1765233a-94a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786357220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "63ab95cb-9426-431a-8cee-a0a12085e3e4", "comment": "Malware payload (ConnectWise)", "value": "2be02d3def1b116c668cc84e628e2065", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "a9e949c5-0e66-4358-ba85-963577e0d70f", "comment": "Malware payload (ConnectWise)", "value": "45c985d787b9f8730c4b05555f8ecf28f9c58f0948c5180108ca185441ab145a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "92c58af8-752e-47ff-a6a9-8134d7625ab6", "comment": "Malware payload (ConnectWise)", "value": "6c8ee646afb6b19ade6af5333c52c5263103f949", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "3455aba6-17c4-4288-ac63-f69b58411a2e", "comment": "Malware payload (ConnectWise)", "value": "c2664d4aaa9bf2afb26f7a84b53aa84325e1c8364b21a5455320df213ef3447e76f001358216b6ada877059e44c61207", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "9dfa45ca-528b-4ea5-9fa7-9d5679c1b615", "value": "T191647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "5a27b501-5303-4e85-b6c8-305b7b7fdc1f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "7c1b1850-d1eb-428e-820e-a4e634c208fc", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9d:J1iw7gryNkSV1hy1Z1u2JLu9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357220, "uuid": "9dcbca3e-4bda-489e-8459-0dc8f048eb43", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357220, "uuid": "25f56d9f-3e8b-42cd-bef1-3183d772b4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "e05b8943-6d29-4e67-a8ce-04c34dd20991", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc18abc7-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "5aab879a-5de6-4f3a-99b0-8afedccdabe6", "comment": "Malware payload (Vidar)", "value": "05c98470771cfd7a1fc0b1ca62e317a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "638fd5dc-0b2e-4736-a54d-bd33084e46c1", "comment": "Malware payload (Vidar)", "value": "4636ec9fdeec97f6dd7b626022350207817c69635a0418a73092a53de67bf167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "3636cbfd-947d-4213-9d37-96d22512be3e", "comment": "Malware payload (Vidar)", "value": "5e23f0fcf22e62f03322f687b787db6e69f6e39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "9d271036-4e76-4601-bca7-a2b683e673b1", "comment": "Malware payload (Vidar)", "value": "562c3b8ec25546896670ffa792ed062263215b0a16611a42ff23706db15a2cebee2d5362bfcae6d0a5b70f035f21a856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "c92abd19-edc2-498d-bf03-abd33df01bf0", "value": "T13B828345E017AEE4C4D5C333A79A566315FC7C2022329B3B6FEC6B2A0D92370E6552ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "043a521b-c0bf-439d-91f1-9a238312f557", "value": "f6ed7a812e36f2c87231645354e7939d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "1389eeda-a20b-46f7-9b6c-b76ddf1e2864", "value": "384:hL9miM3OYW8pjEvsCHbxiAvibdny+lwDkUq/lJu:hALTCvtXRoJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368234, "uuid": "008b5310-8fbc-4834-8f79-8b0cf2212ea6", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368234, "uuid": "3c7a1c74-83ba-45fa-aace-f5b95fb125ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "d570ec5b-3d82-4af7-92ca-eeb2d1169ccc", "value": "4636ec9fdeec97f6dd7b626022350207817c69635a0418a73092a53de67bf167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b562d73-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "7f88ffb2-f450-43ad-90cf-ed585a0b5e92", "comment": "Malware payload", "value": "bd7f26f4fbb6a6b070db642cdb5689b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "97d60f85-319b-4d3c-abe6-4ee335dce06f", "comment": "Malware payload", "value": "463e2b5492a1858159c7a8bfe64820eec9bbe05fd60c4d39254da778008c6469", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "8bec3cd3-cf3a-4f95-8266-fc5abb318d60", "comment": "Malware payload", "value": "02463c446f247ab4ce67528d666f47aa763da569", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "e13ce40b-2411-4d91-9543-2f8e20a68557", "comment": "Malware payload", "value": "e04a6b8e6730b31662eb7e4c6e0ad116e80770817a518269eb20f49d66ab0895097b693bddef93a8adcce01272ccc32b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343027, "uuid": "777fedb6-14d7-44e4-b7db-c69dbbadb945", "value": "T1FD11E9C5360629B2DDAD9B1D7C52C8B2D405A3CAE8C3257848B96C2B1C84F2CB84B91B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343027, "uuid": "5e396a83-da65-456b-b794-fdc77f51831e", "value": "12:KrHcHA1HA8HgjH0HNZXHb8HEt0FH9H2QBsUXpIvRffiFl3zUzE1tjh/ZBsr:084J8UTIc8dWQq7yFxdhhqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343027, "uuid": "88941f5b-adc0-431c-b5d1-c49d957803de", "value": 856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343027, "uuid": "ba7102db-bb5c-4b1a-b44d-d6c603ad47f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343027, "uuid": "ef8c242c-fdf3-4e8e-97fe-bd2a7577d22a", "value": "Exodus.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314e4ef6-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "f58eac8f-e57d-428d-bed0-337a4914709f", "comment": "Malware payload", "value": "049ec27ea3b154f03f8baba26dae3308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "1ab80ad7-4c5f-4bc4-8f77-82fb290c1a22", "comment": "Malware payload", "value": "464f3d79673b3bd8bc3b9f3ddafe38275256b2edc870f5a80bcfa1574d18edcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "830666fb-d4f9-4131-8c4d-9628d331c3bc", "comment": "Malware payload", "value": "7871879b6e7e649b7df001ddcd9f61b27f730c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "1a477eb5-ede2-4142-916a-5d895608a34a", "comment": "Malware payload", "value": "ff7e61752c44bb249afec06a06a0229e411de236ec5d67251c824c9165bb5fd756f4e6d2d395236491fa268508f7be0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "b415f3ea-dbee-4cd4-8d54-888f4b69b7a8", "value": "T12355BF21B69790F3D6553A7014BA2B3F9E3DAA460B24DBC39364EE2C6C331C19D3715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "1168a4a6-7a3f-41c0-89b7-4f2029e245bd", "value": "4ca36c0623611345ee5fabf3cf68d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "c40911ae-575a-4d1b-9f6e-30b242f2013c", "value": "24576:EqqyOTWxNBxj3oElG4ADM8pa495kQwFn3nWBWic9uRt2Nr:EqqyOWBxVlG4cPs49fmtic9lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372296, "uuid": "bf42e04f-b1c2-417e-a4ec-582886305072", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372296, "uuid": "4270be08-e41c-4687-b52f-942c0844221e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "9bb78088-a7c9-40cc-bb72-f69a1da409d7", "value": "464f3d79673b3bd8bc3b9f3ddafe38275256b2edc870f5a80bcfa1574d18edcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076f3f9d-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786329706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "c809c506-1688-4e02-9871-a0d0fbb56fb5", "comment": "Malware payload (Mirai)", "value": "a60f835033d559d2a83132212372f837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "5cadf247-f14b-4e06-90ba-be7e24e2299f", "comment": "Malware payload (Mirai)", "value": "470a44a079d8194bd10e4c19bd63cc38688b2fce21ddfdd6657e1e6caf7401a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "30715a20-4694-4b14-a5a7-fa4effecc5d5", "comment": "Malware payload (Mirai)", "value": "ba47ce7d5528f300ec4a32e369375da70e775aeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "43a812f7-4fa5-4f07-9af9-4a3044e78350", "comment": "Malware payload (Mirai)", "value": "4b7010f2722fc4368315705946a19796d566adc2505468701c0e0ddc3b8840a147d58053f39ece9cba33ae56a2147a8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329706, "uuid": "daa4a0f8-5c91-45a3-9a91-198a25b65a76", "value": "T147031B46EA519B09C6D272BEFB8E014E37176FA8E3ED32359E306FE013825E70935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329706, "uuid": "1c30d4f1-b8d4-438a-9cce-4c9b104c5563", "value": "768:MknfZ7W0BFWJpzunYeNLDvm9pJ5M8Leio6hg+wd9SaVjHgyh:Mknf9VBFWJpSY2SjDMTio6e+wdRgyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329706, "uuid": "736589fe-73c5-4184-84e9-c49015f954c6", "value": 41128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329706, "uuid": "ff5a9fe6-6da7-4ecc-be07-d3fbf6717bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329706, "uuid": "fdfb9acc-e43c-4d51-9d98-def8f50cd60c", "value": "main.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6490b10-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "548e2420-d9b3-4a9b-b133-01d43851975f", "comment": "Malware payload (Vidar)", "value": "d0561ecc04bf9ff834e5496c8a3a5fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "29a253d1-dc8b-4e1e-a42a-3843e54c12f3", "comment": "Malware payload (Vidar)", "value": "4710b1ec5eb0dfff19678665ff727c32968cd113f59c04de67a4e45388861cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "d6dd6335-fc22-446f-80bc-f3346959df72", "comment": "Malware payload (Vidar)", "value": "b7daff88a4186c51766c04bfa22907e4c0f7827f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "8fd50e43-e3f4-4ebf-b4ab-ee86d63d2d99", "comment": "Malware payload (Vidar)", "value": "ae0c75bb48cf5f56226f5752ed08ec6b7a5070f061f4e327b4666d8c94fbf5e0c2fa87b92f0d58e232583e5d52fdb089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "7742442b-4944-40b1-b677-df54c5774207", "value": "T18A925E46E15B52F4C0EBC337575AA12756FCBC052236AB3B9FDC5A610D02330EA682ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "28a48dc2-58c3-4999-9988-3d2ff1455880", "value": "e94e649e836c8320627dfabdbb134df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "31d45bfb-13f2-4de5-874b-57263044842f", "value": "384:OHAkrKM7JBeakkvqk/h9CCkWI2W/fuxl:uKKkkvdRIl+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368305, "uuid": "f631da95-6396-47ac-bffc-5e40ff23add8", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368305, "uuid": "05cc1244-879b-47ba-b1fa-bfec3b62458e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "06adb862-7a8d-41a8-8b80-8226fb786429", "value": "4710b1ec5eb0dfff19678665ff727c32968cd113f59c04de67a4e45388861cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f065c48-94f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786392881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "281075fd-9f90-4215-8412-764b2b93b71f", "comment": "Malware payload (Mirai)", "value": "4be4b3545e5348e18f57c4147e5fcb64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "63b31a97-ab7a-4283-ba2d-98413370620f", "comment": "Malware payload (Mirai)", "value": "472f4a7e637a974902135e6a2ca0a3ae4ef2c8e754beec0e359fa10e12c490d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "579211fe-53d4-4edd-870e-66655fb0c3c5", "comment": "Malware payload (Mirai)", "value": "b8f3249252446937e3f33cde43acc846c9ee60ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "6f9d7138-d2cb-4d84-a7a4-aecb0f4617a5", "comment": "Malware payload (Mirai)", "value": "2b91cfb899f061320d55d9d70ed8a0f007080fea993c940fe8f9ea2f25d473011216c219a05a3ce8341bee54196da1f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392881, "uuid": "8bf79bd0-b3f2-498d-b4a8-7f934df07dbb", "value": "T187F3E70ABF610FB7DC6BDD7702E90B1529CCA81725A53B757134E818B50B68B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392881, "uuid": "ac38eefc-51c3-4ab7-9d03-0953dcf3352f", "value": "3072:vLMayco2uXZrZKpGk9Ct+qnGC5T7bpeb7ZSa:jJyco2uXZrZxPwqnt7E7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392881, "uuid": "ece63fb9-c0c1-4d8d-ad53-f6cee61d8fd4", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392881, "uuid": "84891461-440f-4c74-a18b-61c189d8f469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392881, "uuid": "a0bdce03-229b-4ec1-b53d-920285096673", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7effb07e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "7365eef3-8be2-4f25-b3f5-30e0304cf0cb", "comment": "Malware payload (Mirai)", "value": "be0973c159166dc47bc82c2e4d793bff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "0ecac0d4-3694-45f1-a923-6e9d5f9177b5", "comment": "Malware payload (Mirai)", "value": "474979d43bcc34ba4c897a0397042a97453989f84e4f41b7dac9c1ed502d9905", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "8e4cf474-2173-4e8a-ae7f-cba6e7d40240", "comment": "Malware payload (Mirai)", "value": "d3695e4f362cdea85b59b60d1b6c623153e2d848", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "b62ebc73-7359-4563-8f22-28ae3710122f", "comment": "Malware payload (Mirai)", "value": "80867cc50263850157da6a610b1edc3e1e171072028df32db66b55fc40202ef852d773935ff36c23e8332b148e5d1df7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "46216ed8-8315-4218-9bd0-bd90bb7539fe", "value": "T1ACF36B82FA83E2F1E5971570001BA72F4B319D398224DE1BEBA42E31DCB6706565B77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "e66471f4-6cd0-4898-997e-3c7e9f07110c", "value": "3072:mmLZS7lephFrgaEZFbfbWaAf4nxvWmkbjWf22p2y/PSWTaj4vkRazlTtJ9pdaJN:bLj3OFZFTbWag4n7kb6fpvTa5MHJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383593, "uuid": "474420b0-a074-4aa8-beb8-4eaba68d22db", "value": 161204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383593, "uuid": "50bc0b3d-6d67-478c-9855-e05b486b83fa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "6ba90389-02fc-4b82-8274-6e9d3a18ef01", "value": "disconnectraw.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de185d4-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "fb53db4d-b484-49e1-85c8-596f03d046a8", "comment": "Malware payload (AgentTesla)", "value": "a6d9343937044aa2bbd88242d974ce2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "ec7f3a3b-dfdd-4d10-b415-c7083dfeae2b", "comment": "Malware payload (AgentTesla)", "value": "476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "adacceef-d463-4329-894b-60ddaaeaffc1", "comment": "Malware payload (AgentTesla)", "value": "40d33bf4f95194808ba18b5d818810c3026a5c32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "414f8011-f222-496f-aa40-442082707c2d", "comment": "Malware payload (AgentTesla)", "value": "d22fd502087ab3bccf304192941932f687e1e95afe988cfb732eea907bffd594a9a57d8283612ec88c4d75502e43c185", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "2bb4b105-487b-4646-b6fe-57993ce6bd6e", "value": "T1F974F141B780A667D5F14E7359A7CB725372AF754702470BE394732B3EF22839B0A288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "6b63e4cb-a8dd-4520-9d7a-38328268f99f", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "29659829-b8de-4fb2-83f1-0c3768ea8944", "value": "6144:AicFyQyEBErg9v0jhbq9IBszA6xXu+Mh9rdRYjZIdLgliE:rgEcx0jhbq91nxe+O9rdRY+6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374035, "uuid": "bc15a06a-30d6-47c3-b3a3-1eaf65b0f13f", "value": 347985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374035, "uuid": "ed257798-fa66-40dc-ac48-9b4667269484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "a8e1ad09-7a32-46ca-b3a4-9d036edbf0f7", "value": "476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653ef99b-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "80e956b9-ea5a-4e56-888d-24a0b5fc1199", "comment": "Malware payload (Vidar)", "value": "5a8e5550b118e3111a1380cebca0535b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "5804a051-74c7-4dca-a9b5-a6cb50d9002e", "comment": "Malware payload (Vidar)", "value": "47adec31c117914388b712ced06aeb54e41d666b13fe61c24051e557bd5b7ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "4d55b882-a53c-4ad3-9225-16f88243a93f", "comment": "Malware payload (Vidar)", "value": "a0fe4f2c49b345e8109814803c78146114ff0c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "106db9f1-63fd-431f-9b40-6bdc4c685f68", "comment": "Malware payload (Vidar)", "value": "0825c9936203f76f13b4cdfbb2b8fa54e02f4a25091363dd6cbf6d20ceebbf62441b39c769668008b312a8f9436e007b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "203306f5-f3d2-43d6-bbc0-1cd8fddc5f7e", "value": "T195929541E107AAE4C4E5C732675A126765F8BD2021369B3F5BDCBA3F4E51330AB442ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "4cd8273f-dcdc-4a77-8a9a-d6460e1a9f98", "value": "85b0aeb0d13fb5c7226c80e10830c4fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "041f5850-ec0b-42ab-8907-8aee708c4c37", "value": "384:QHkYQfgHeu8eKhoMoEkLKdPvqOgTHkvRQCwdpDXEmb80jMMO5lwYp:QHkYQIHfKh9gKpE6xwdN0mo0QMGw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371095, "uuid": "4d89df1f-3777-4491-9d72-3ae86f2725c0", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371095, "uuid": "bd6bac72-aec7-4830-8ddd-0f6d749c36ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "a5ed4b8b-8620-4699-8e48-c5f920dc76f5", "value": "47adec31c117914388b712ced06aeb54e41d666b13fe61c24051e557bd5b7ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b072f51-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786327779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "a26ef1ff-e6b6-4e7c-b279-26eed642fcb8", "comment": "Malware payload", "value": "49d67a68860e618990b70a8bed6c160e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "2f84f7af-c445-4a84-a5f4-95056686a248", "comment": "Malware payload", "value": "47c89331a453ce7d3a340dbedd22963e97926991ad405272ebc9bfc0df410e3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "e5714476-11dd-42b7-83a7-68ae1432845a", "comment": "Malware payload", "value": "95b3334112d9d5bd29afb5167d54ecf674fb5619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "a2db4e63-22f7-43ba-9eaf-45d6c34b3f30", "comment": "Malware payload", "value": "348c1c66a1b14d8367bcd21525fc5e4947b7dfd1df6f7329f31791d1932167b9f3483673b252ca24339e8a694e84033c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327779, "uuid": "32c0e969-0671-4865-ae65-6ded69cf9520", "value": "T1AC630A95F840DA35C7C075BAFA5E02DD33130FA8E2EA31158D21AB353BF7A594A3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327779, "uuid": "59361ed5-489d-4682-b70b-f70319fd749d", "value": "1536:tYSAHU6DnejFhsX4XMwb4nFxj5ITgqDMtAnDndzlnUHY0zlpcwhNOkC0r:tkq/ineHzdzlnUrcADX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327779, "uuid": "9af1dca8-6ee9-4220-8f64-6d739597c863", "value": 70536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327779, "uuid": "3b9f13f9-aaea-4250-9a33-be10ec028d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327779, "uuid": "358e8aab-fc47-478e-92b8-1208734fe104", "value": "main.armv5-eabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9d1286-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "7dd793c6-4403-43c6-a702-b612f48efefc", "comment": "Malware payload (Formbook)", "value": "b6818dfe0f1350aea64b804b5ff43c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "cc5d46d2-c058-4a8a-ad7e-f976d3edaeb2", "comment": "Malware payload (Formbook)", "value": "47f274e9fd4143dc1cf9cda2e69ac95174ee075873a8be6398b14acefff2e8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "577a3241-3b7e-447d-9f1a-2b5fabf7c36b", "comment": "Malware payload (Formbook)", "value": "1de84717be748b76e2edaa65f5cf9c4feed0cf13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "13aa84ee-3c6c-47b6-a5ef-617ed0ee0ac3", "comment": "Malware payload (Formbook)", "value": "0042bb4b3685f0bc38c0c564ef4ca7363865ebc163a9dbdbea5d71f48331180067df9760e3d8056a40c976dd88cb60e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "c7bf3f8a-41ff-48ba-86db-4dd483f17b6e", "value": "T1FE15022423568A02E0E687FAB960D33433B51DCF39E2D3D69FE62FF779193811954682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "ed0bea0b-daf5-4dd9-8ffc-10ac172c5dd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "c79a2a09-e8a4-4d8b-80f3-9db2ffb66320", "value": "24576:nGp50iUcf+xNID5W1mZp8cbWjrvF9JUfeGtg+:GpniNIDPPFnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372909, "uuid": "08b6b6cf-32a9-4fd2-ab49-ae45ea2caa84", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372909, "uuid": "827f7ac1-ce75-46db-8d78-4b20f0d24b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "ecb07947-7c1c-45d2-863f-468501b5cb9f", "value": "47f274e9fd4143dc1cf9cda2e69ac95174ee075873a8be6398b14acefff2e8a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fded1297-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "128c1c02-f0fb-469b-9841-04dd11c4238d", "comment": "Malware payload (Formbook)", "value": "bc8fc58d0d007e4c06b3e7e1fc64aeea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "d74fb078-e67b-4ced-b92b-083fe93fef1b", "comment": "Malware payload (Formbook)", "value": "4859f893660b9e29b06db46f52299f60ad5d59beaa3977d86557b632c965a2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "3d817161-1c33-44c2-ae76-c67bf09a9dc5", "comment": "Malware payload (Formbook)", "value": "0246037d43e3ef8267735b8484f7713089bffe34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "5a551f7b-ef46-4c2f-b06f-ef695c6225f8", "comment": "Malware payload (Formbook)", "value": "d3707d06b4558902381c81bd2bdfdff24974f3a8372a3252187fc27f67cad0848833b13fcee7e5e0c77d640b138fd7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "8798ab09-fce5-48b9-b906-ab16c5a544ca", "value": "T170E58D46B3D80AD4E5E7CA34CA199732D7B1B8560332975B1B64C30A2E77AE34F67321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "72c66230-b9ad-4890-ae7b-873bd1f1dac9", "value": "b0253ae8279600c3d8dc02919670baab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "4d89daf8-ff81-4173-96cb-d0650ba922fd", "value": "49152:/1/YpqU4fDaFThvDug3jpgFDttr+Am0NCFWp:R0JTj0NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371780, "uuid": "2ca610e5-9942-45a3-b626-4fa07e5970fc", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371780, "uuid": "1f6c9032-29d0-4f84-b872-b193126840ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "31f1fd2e-3dc9-45b9-a7cd-ac9be4e86906", "value": "4859f893660b9e29b06db46f52299f60ad5d59beaa3977d86557b632c965a2dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8101e28d-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "117e3155-0714-4a57-bb49-e3c5992f9d8f", "comment": "Malware payload (RemcosRAT)", "value": "d7d3c565433be9f9b975300739afe114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "bba9db92-0244-4c93-a53d-d2cfca0438fc", "comment": "Malware payload (RemcosRAT)", "value": "486737f53db4aa7de0e645979a4b318a6125f8bd8e3b25547ebd98816bafbc36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "409a7b15-a6a9-491c-b269-514781f53bc6", "comment": "Malware payload (RemcosRAT)", "value": "faf0bcca3702eca5e297d1df1da3b86b2b8d83bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "7253cf10-e948-4aa8-b8e1-fb6bc46ac857", "comment": "Malware payload (RemcosRAT)", "value": "ddd380a2954c991dfd4cee536b6a8d51a801437ae3bc39582e4af4c85e441cb3745eb7c180de49d0b7724ea94ab78068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "31ba8f00-3ccc-4d2f-beaa-f5a6cc8c81c8", "value": "T16E55231CDB4BE902C5515639ACE5F2B033BC1FDCEA42D613AFDC6D6BB924B5A88400D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "831f56cb-d960-443f-b810-28e9573048b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "2b13f02b-0fac-447d-a066-493cd325a4d9", "value": "24576:BL58tXXs4WQuWGWz7MKZ4SNhg+WjNbZPSJLkRZAkWgwFLI6pw/:BetXEDpWzI+Jg+WjNbULkRZNV36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372000, "uuid": "e69dad51-f25a-4afd-bcf6-c6281f57f458", "value": 1283072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372000, "uuid": "aa726423-d8a9-4faf-bc28-2c0719de7b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "1cc25fe0-e5c8-4c4f-b2f1-a01d556d3a18", "value": "486737f53db4aa7de0e645979a4b318a6125f8bd8e3b25547ebd98816bafbc36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214fcbbd-9486-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "82c0cdc7-c373-43ff-a96c-62f6e2dfeb3b", "comment": "Malware payload", "value": "7afb03f33a1b22c7a12598418495156c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "c5c36c8c-21dc-47f2-9486-460ec851572d", "comment": "Malware payload", "value": "48f39608f83b35a4ea8010d50754c5d5dd0ef5d2a1e47db2eb17aa58b0654591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "9d3a1307-0d46-44df-acfc-cccca9f675d8", "comment": "Malware payload", "value": "67038a20653eaeda5038e6ab0f72b61ccf496e2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "c3570af0-0f67-41c4-a536-99f47454b255", "comment": "Malware payload", "value": "9afbc0b126845dfebe95c76a754d305ef1b8c3db9d0a91abfda67ea4acca41a884b0e9fa9a8e71228d587181f1e6caaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343923, "uuid": "357c278b-efbc-4b29-a739-6e6fb021c9b1", "value": "T15DA36C47770B2880F82202F167DDA3E03F1561CBAB321EB7586A62F76FB31991D09752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343923, "uuid": "16d6909b-12bd-43df-83f6-6336646a81ab", "value": "1536:/wlF3aklNUWWLCdjKHnKIA5tax34jgLxUn5p5M/LWv:IlblNUp+d75xgFhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343923, "uuid": "8713c9d3-0281-4de5-8a09-ea3f88e2c49e", "value": 99828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343923, "uuid": "b95bb74d-f8b7-48dd-82d6-2eeec1e8ff5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343923, "uuid": "8309f773-e9d5-4d8c-a791-2f6b54ef0655", "value": "main.archs38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06879193-94ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786361057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "cd395922-673f-4d28-a8a6-0531da9ef1bd", "comment": "Malware payload (ValleyRAT)", "value": "bf2db66718891a55da5d82817cab742d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "f0960074-7719-4b27-b4ea-0671d2b55c2a", "comment": "Malware payload (ValleyRAT)", "value": "4972c57c77b67c080fca0e1f97e650894f7b60fb50d049ae9f43d83759fad701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "b59007c3-edfb-4d0c-9daf-1d13cc59cdc1", "comment": "Malware payload (ValleyRAT)", "value": "f0dc5b597d28aee11eeb68ffe2a1d97bb1f72d37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "bd488020-1f11-4d45-976a-7d74c712bd0d", "comment": "Malware payload (ValleyRAT)", "value": "c11087612c3488541bf6de2691b723198fb751ba3113afe913d09714fe63358ab197abe6ec844dd72bbc37e3954734d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "57167856-a798-4ba1-ae8f-00acee5080f3", "value": "T102F57D87B6F61354D9B7C138C6A7616AEA717C428F60A9CF125CB3191A736F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "6b05ffcf-abc1-45fc-9aca-a46f1364a481", "value": "1d6756920139c62afca29cb579fd4954", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "f8395dd8-f89d-40ea-8ebd-1e177afc6d20", "value": "49152:JDAn2xCeeraP8k9CVrggiL8PhzhJsv6tWKFdu9CcPTvG72MqOqRsjfJXcRWYNoi3:qDC9dQHJsv6tWKFdu9Cci4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786361057, "uuid": "670091bb-36f3-4ff8-8848-b7dfbb447eb1", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786361057, "uuid": "195850ce-b1dd-468a-9843-456bd5a3dc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "f678fef0-267f-4cb2-99e2-71a847ef63e8", "value": "2026.08.10\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u68481_SUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fb8bc2-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786346368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "be24efe3-35a5-4b19-a354-cb0aa4e80078", "comment": "Malware payload (Mirai)", "value": "1b33ce9f707643849044aa530815cabd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "baefa2d3-1956-4101-bb59-3ca7cb15bb71", "comment": "Malware payload (Mirai)", "value": "49953426505129ac957c0bb48791d63516d008d85d22afa711e62403cec7ed06", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "b87257b9-e5dd-4c9f-8a5b-1a696df77d76", "comment": "Malware payload (Mirai)", "value": "73de854eb6bfba70167b69d85eeb91e8e3f2a0de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "6e2f3cfb-3b12-4555-9aae-5735a7e49b35", "comment": "Malware payload (Mirai)", "value": "7b24e359a245a30288a86bd481e13a45ff9d7a2cad630c49582a403507a9ad7099edb53fb3ef95ed11bd992e58d80f33", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346368, "uuid": "4b2a71c2-2cf9-46fb-9b7e-d33f579116b6", "value": "T1B801C2D5D1505E044069949E32E756E0B831C3C7495B4FA8BFDC953DEB98E04F0B6F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346368, "uuid": "d85df4c2-a18f-4599-aff7-fddeb6b7c90b", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaakCmFwFC7huCFR1B6FCYKgV+3ClauD:kXCKysE2hi0ziQvZohaNqFWcNFL807", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346368, "uuid": "6ccb8c72-7f95-456e-a683-04c93df6ecde", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346368, "uuid": "134e2396-90c0-4832-9291-5587e98b90bf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346368, "uuid": "5d2a65e1-7654-4076-bfff-2cc766320818", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4459cb17-94d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786376623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "c508c43c-3e7a-4ab3-ae69-1fdc1d1316e0", "comment": "Malware payload (CoinMiner)", "value": "6e6d89b2950e9c427f8455166c15519b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "9e844de8-eb22-4eb2-876b-94113abfb4eb", "comment": "Malware payload (CoinMiner)", "value": "49e714b951da38e4e74534fdf2f2905ff59b81804936fe6b639343ff5f30cf41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "71f1b924-3fe6-4418-915e-694b629c4b6e", "comment": "Malware payload (CoinMiner)", "value": "a90bcd318ff68173f4f621273933b17891fa7c47", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "f703a6ae-f6ea-4caa-8665-eaad02c57641", "comment": "Malware payload (CoinMiner)", "value": "e17fd3e2587b1ed7e9e065e163e9e151a2cc66123b7ab94c440e58756d370ebb0a38ddea657a0b0eaca4950cad710020", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "bc87d6f1-edd8-4494-a544-1be423dac893", "value": "T1673633C59DE69571C016C3F49522207CF23ABB5A9765BC07BBCD9B10DE26B186A3E3C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "e4b246e3-e149-4bb7-9bed-119efef5b09e", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "da8039dd-ca02-462b-9b06-c6d1b135c73b", "value": "98304:ye8lXBjxrm3Y+CvVuOtibBbohtJol+88kIg4aATOLy8R+39iPr5KS:ye8tBjxr2fOGehtNNkOaATB73KFKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786376623, "uuid": "cd4ad56b-3be7-40ba-a854-c507ef49c854", "value": 5247488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786376623, "uuid": "a4463045-3105-4fcd-b5fe-e9a0fe19229c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "e0f79422-534d-42d2-ba62-66f081f25ead", "value": "49e714b951da38e4e74534fdf2f2905ff59b81804936fe6b639343ff5f30cf41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7c1537-948f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "72c506fa-6f54-43f7-aa9d-1f08bfd4d90f", "comment": "Malware payload", "value": "52f953a5a18059b9cd9204fcec0d2a34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "210a6f33-2f82-4342-9db4-c008d5296578", "comment": "Malware payload", "value": "4a05392d745348f925ca7371cb291d22646d6e918bf7c552d17c0a34cb4e2041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "2564621e-0315-4ba2-87dc-93535266da7c", "comment": "Malware payload", "value": "94304b38fa73263f977da71625cafece61f2cbe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "4cb35ea6-4baf-4da1-95be-11256c3b40fe", "comment": "Malware payload", "value": "39a846067c4008bb8a7a80d8cc8e60bb4fbeebf17ef5ae22189cfd601ee9d4a3cf91972263b2008ecc90282d0c5c9854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348077, "uuid": "bf5d3db8-2b4e-4828-b1bb-e88e683e3d2a", "value": "T1ABC23A01F3A2EDBDC8D64335481B44B079B8A8B5DB714BAF678087B72863B5C8D2E715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348077, "uuid": "d2a7bd92-d577-4bbb-96e9-01930d19c17f", "value": "384:YuvdvOm0FmjGxQWDj+3/KERT9JyGeoCU6:X1gmjGxQgja/KeOGeov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348077, "uuid": "a99346e8-88db-42e2-ad00-358fa2abefce", "value": 26984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348077, "uuid": "ebce5dcf-b4df-4648-9c1f-4d835be03750", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348077, "uuid": "9164ac64-145c-4fe8-87d7-d1f02ae336fa", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dbab48-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786373218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "22d6f12b-d855-40c2-931e-b35d11b0a677", "comment": "Malware payload (MassLogger)", "value": "18899bbab5c273e374312140c6280229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "3b894b53-d89c-40e8-93cd-fef6c503ae2d", "comment": "Malware payload (MassLogger)", "value": "4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "3c302107-9ec7-4ba3-9e89-e6d152df561a", "comment": "Malware payload (MassLogger)", "value": "acc597aad24c1246bd479bbd84b275e233daf426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "dbce5350-16ad-47ae-8afa-b780424c7479", "comment": "Malware payload (MassLogger)", "value": "475a111d0de066863ca5100503aa8cf3c22f4327870341b89589c035590dc26759285b694451596f1d74145d87c30600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "c3840d77-439c-4364-8fd7-bf9e3917346b", "value": "T13215F0442306EE52E0D68BF7B8B0D37433A40DCF78E6D2A65FE56FE734193916958282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "a2118f26-9b84-487a-b81b-6ef6cf5fc41e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "1294cf14-a778-407d-ab9e-2e1030d00ffd", "value": "12288:tRxxltnn0gp36bQuFDJSZ9mzR5e356rVP7mym8Z2vVGlpX+C+nPQbL5n1WtBgfxW:Dp50UPuFVSn2fTMM2vVGj+Zoh0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373218, "uuid": "ea5f3162-2df8-4ff3-9337-8bd9f90a5382", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373218, "uuid": "e583ee96-f627-4c52-8c2d-4fbe6a8c2883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "b95bfd3f-05dd-452b-a9a7-5a89b90115b3", "value": "4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c68b706-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "2cc2da6b-0dc6-451f-8e45-37a6c70b6fdc", "comment": "Malware payload (Formbook)", "value": "8622a2945b38dc8a5f2d72d59a936729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "d15ba99f-a841-40cb-afe8-e9f7cade839a", "comment": "Malware payload (Formbook)", "value": "4a37a938e5bb17c3b575428e2e9916ee5bab02f8eab91c298bbfbc08f64619cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "941841c6-1369-4be7-a65f-40a42fe04108", "comment": "Malware payload (Formbook)", "value": "2cae375f93ceddca69e1f3b86669da5d1d6866e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "7952914f-045b-4559-9ab4-fa575f268535", "comment": "Malware payload (Formbook)", "value": "c999fa9a502fe981f8a1abfec7c1dfa63044b826fec52614c445a862f79b079690a84f6e3d9d7b783ed5a5ed18c1ae7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "9f12fc6e-003f-4353-9c58-cade980bd685", "value": "T1CC3512C03739B71ADE601931A635EDB542FA1EA87001FAE25DDD7B8B79AE2119D0CF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "0f5d5c21-aec0-4462-adbf-c389daa3f160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "e39a6e52-568e-466e-96d0-ec4c62ecf5ee", "value": "24576:a1B68MwCXZCapX0NAUGd/qfHP2sAHUF0txyKv1:akwCJZd0Bi/sHPJA0FPKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368369, "uuid": "dacccfff-1bc4-4f3a-83bf-118aa99c925b", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368369, "uuid": "9fdb6ee8-34df-42e3-875f-75b1c9fe1ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "6f0c64eb-063f-4fc1-ae9a-8acce3e55e68", "value": "4a37a938e5bb17c3b575428e2e9916ee5bab02f8eab91c298bbfbc08f64619cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97210d87-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786329947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "79b51e6d-f50e-436b-b413-c63eaacd79e2", "comment": "Malware payload (Mirai)", "value": "2a33bd8a38db1eabf63f06745c785ea8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "10840f26-4af4-4a2f-8127-12611d145fc5", "comment": "Malware payload (Mirai)", "value": "4a5fa9b54c1531a1061c3c9f41e8f68e355c3f5cfce9877da2f5c754c0b108f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "18f33ac0-fc55-4b10-babc-f3e76abafa2e", "comment": "Malware payload (Mirai)", "value": "cb79072efe24e2aa8ef59e5f57e350b93fdc2069", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "d170a466-1caf-42a8-ba2c-81d08733558b", "comment": "Malware payload (Mirai)", "value": "2695017f26728f91b98126dda63f5eaaa6d320ebf4a0276d6c7930dc2ff55117dc7eb8ad4e453412ce7c9f4c32e61b4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329947, "uuid": "33a2b5e2-d08b-48dd-95ed-470d497f10eb", "value": "T19AB43B51FC419BA6C6D12ABFFF5E828C732317B8E2DE71129D155B2173CB85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329947, "uuid": "4cf87061-30ec-4c65-b628-87b54db08499", "value": "12288:eZqx3crcbwYjEieDmIe/dzQozr4mKVt6cP4uDmJibHe:9cfuIiPH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329947, "uuid": "ca085cd3-7a06-4827-b5ac-1b8dcc1c470a", "value": 516960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329947, "uuid": "81d25919-5820-4788-9ac7-7fab940dd531", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329947, "uuid": "dac34996-be2c-465d-8955-69635918a8e1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffea022-9471-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "61bfddbc-d027-47c5-82ef-3f3c60e37b47", "comment": "Malware payload", "value": "65eeeba00aad4a238ba0e8e7622d8b55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "42654cd0-1001-474f-b494-be4bdc7b2d49", "comment": "Malware payload", "value": "4a70a4a775f5f056339e43bb8710863780a8ae9b59f991a392c2bacc31ad6865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "c984fbb9-f49f-46d0-9a18-68c78787769a", "comment": "Malware payload", "value": "320d59828dfd74373f9f1206c5f383bf2c0c066f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "56451df0-68f4-4187-816a-a20d27bf5fc9", "comment": "Malware payload", "value": "565c6be42ba5c40c501762755cd4da174c15a7087ce047580fa2641779b9731a545cb477fc5744b0db9ea3daf4c86b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335223, "uuid": "22148bdd-5a60-4c9c-b709-2678505cf826", "value": "T1BA53F723FF0C4017D49369380A3B47EDB311BE5160BA9516330A6B6F2776E316687BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335223, "uuid": "3f912a6d-5b74-4e04-bb02-c88246c793fb", "value": "1536:/2YS4750CSFKbTDl31QfywSX/IwPf2H3oH:/xS4750VIbTDlwyTX/Iwm3oH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335223, "uuid": "fa5efba6-4b2b-4240-a6eb-64646d31c898", "value": 66456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335223, "uuid": "2e07dd14-3dc5-43e4-9dcb-3bc06f9834ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335223, "uuid": "4f33d022-56d4-4c81-8864-b492d1db81db", "value": "4a70a4a775f5f056339e43bb8710863780a8ae9b59f991a392c2bacc31ad6865.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df937485-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "3f7279d9-3c88-4ddc-912d-3e8e94f83def", "comment": "Malware payload (GuLoader)", "value": "60dd7c6075cf1b57f917c6aa7d3260e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "c39b191a-85c6-4682-8a95-7ad633178d94", "comment": "Malware payload (GuLoader)", "value": "4afdcbb6f8a56d3a875a618e9d644922937d768a5b6956e2e8b7b8969238b39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "0bfe1244-f159-4e74-9303-1935450bcd43", "comment": "Malware payload (GuLoader)", "value": "d9f149e9822abdeff6271904c2f50490596eb2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "14197fb1-31ce-47ab-a21e-812b98b66c85", "comment": "Malware payload (GuLoader)", "value": "56f1ef76ec5cdd2d29d68fc39eb1fe9ba3127f17e29501df0d7a6f7e889514c9e6eb26aead6a365b09e96f9367ec5880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "455ada57-a301-45dd-99c5-0f76d3aee426", "value": "T1B644E106B3B6E267E56249310C72CFF1ABD97C166C906A0723B5335D1C76B81FE07A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "d89a8d6f-cc68-41e3-9dc4-2719f1eed0e0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "b81a4002-7cf0-4212-8617-3d95c7fcee0b", "value": "6144:pbfopygwAw3+D8oErNHXbetgN4C6RX4xDA:pbkn6+D8oMhigNqRXMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373018, "uuid": "0de556e0-8972-4196-acdb-51e77185c951", "value": 257151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373018, "uuid": "50ca8a0b-1e43-4652-90e4-ca4ea60c5729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "831c9d7f-eb86-4342-8172-e313128e42eb", "value": "4afdcbb6f8a56d3a875a618e9d644922937d768a5b6956e2e8b7b8969238b39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5d71d4-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "c5168620-c143-4efd-8a8c-e2c5847686e4", "comment": "Malware payload (Mirai)", "value": "e4a5aebc9b45c2554030a20ff3d02ea0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "218390fd-8378-4476-ae29-eca4548c264d", "comment": "Malware payload (Mirai)", "value": "4ba7a1e09e8d4dc9c9d45ab68ef7a6fb62543f8eca79767daae6ce258b249d4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "74595a05-17d8-48d3-9a46-b3cd0df59ec7", "comment": "Malware payload (Mirai)", "value": "6135033dceca1d9ace7584855a13ea7bf9e8939d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "8743ea98-eb16-4eb2-8692-cc6eb6c8ec87", "comment": "Malware payload (Mirai)", "value": "c31137ee0ee8054873a5a3cae87cb7236f3727a555bbb5b663fcc494bd7f7c2b4279cdb8c58555031be26344bab7bd66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353818, "uuid": "86798b63-c7df-4dc2-bfa1-63ce5d6a94a8", "value": "T1E8142A83B905DEF6F40EAB7204D30B257231BB660A531A32B31779799E3A2D4346BF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353818, "uuid": "60415bcf-3c0e-4382-8692-a7eb8a0862ce", "value": "3072:Sv2547RM8GI7y/SO8xngYKzGcefaJBw3LNhzVRFV9v6BG7oxXkm2CLf5QwD:c+4y+y/D8xngdGcCLpRFV9v6BG7oxXkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353818, "uuid": "aa3ed838-50fe-4b03-9bb6-93b9740bd71e", "value": 191618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353818, "uuid": "ea09251b-e9f4-417d-9979-33ecdbcfd676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353818, "uuid": "3a56aa7d-b8cd-4996-ba4d-293e539c57b4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf523ce-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "2817c63a-8e5f-41ef-ab4c-f1ea640a1c89", "comment": "Malware payload (Mirai)", "value": "3b251c8c34fca41217b651e009002f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "48e9006a-3737-41a2-a41c-e5658b6ae07f", "comment": "Malware payload (Mirai)", "value": "4bf680cfc7e35d7a82c8b66816fdceb255cd2957f07026667b1d95c9382c35a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "dd79860b-498c-43fe-ba10-bf5f5f578547", "comment": "Malware payload (Mirai)", "value": "d94fc11ade533a3a5d6f4ed042c225322c0c7074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "44f4d557-359c-4833-a3dd-d366f4219a53", "comment": "Malware payload (Mirai)", "value": "ba18208ab95d4023bf43c6d3c222ba4ca77317d516ddf4e88569e4b06a241203bb107f5f9a5aa45b264777df4fd7cace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339912, "uuid": "704b9ded-eaf7-4bc9-83ba-9bf4ae8daae6", "value": "T1A074FC88B5F2E2CAD1D4EAB5B319784D37630736B1D77146A51EEA3323EF14809BD920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339912, "uuid": "416c5a6f-66d6-4479-8711-b769dcd137e0", "value": "6144:Da9d0a9Xa9dSg+RCsRTIS/CdUpZTh47jSdjZN9+ZCFHkE1:Da9d0a9Xa9dH+RCsv2UTpdl+ZC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339912, "uuid": "3856a80f-4055-4bfc-9a0f-959cdce2cc0f", "value": 365048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339912, "uuid": "04a28585-9987-459d-94d8-95a769eebe06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339912, "uuid": "7724a313-c563-449b-84f2-9d2d4714c588", "value": "pid.ar6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5934eab3-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "5b8ffb45-f1cf-4edc-a941-cf5e44aeb6ad", "comment": "Malware payload (AgentTesla)", "value": "2f94f771cb61ecadb6e12950ddd12b94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "7a80c74e-4539-4840-b353-68125864fedb", "comment": "Malware payload (AgentTesla)", "value": "4c1c31b13205ba0a39b7aa9949fab60a863cc9e54d13223a3b25d4a5b06d8140", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "8b2a4c87-2aa9-432e-979a-56fc18021a98", "comment": "Malware payload (AgentTesla)", "value": "3dd94d5abf38ef596d5116be19a85de7eebe6509", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "ebcfae7c-6099-42b3-9952-b5a266893f21", "comment": "Malware payload (AgentTesla)", "value": "2b99af319facbc4edba420b28da23d4991ae5eca9ab0521166d04f6ac58c7fc486b661fcf7c274e9277c293e6d2bf050", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "054bc330-5b1d-4f33-8bb7-1612d52cd7ec", "value": "T10A84CF9AFFB1F8D1C53C06704B76CA250632EF951A42472B2A54F26F3E726028D67F85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "eeaefdfb-28b7-406b-932c-16a0d8973315", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "734507ba-d48e-493d-a42e-3cef7fdf5147", "value": "6144:A+MvoJEiU4oWwomiaZvNOTTGi0a7QYy1l/jl3VhOed8eEVJZSKhvZX9:A+e4oWwomiaXO+ra/yb/VVhOlLIkX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374081, "uuid": "81a74674-62cb-480b-b73f-107c238893e3", "value": 391896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374081, "uuid": "249eb7d2-9e00-47af-8dac-bea40ba6cc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "824cf90e-b0c8-4b94-ab4c-12a232bb2061", "value": "4c1c31b13205ba0a39b7aa9949fab60a863cc9e54d13223a3b25d4a5b06d8140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19400c48-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "2543354b-6737-4cf2-9164-664b2ec303f2", "comment": "Malware payload (Vidar)", "value": "1293e25783c2f9aae545eedc6f28c67f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "5543d63e-8616-492e-a13b-d404ce99316a", "comment": "Malware payload (Vidar)", "value": "4c2dfdc57b9b008ab4922e6a37e3393f658adddd9469dc096d24fe4a84520114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "551c997e-60b9-46cf-86aa-84965f2022d9", "comment": "Malware payload (Vidar)", "value": "7d2d21b70bcff0d48b3702a7ab7b0509332754e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "819d6756-a929-4f1a-b35d-78a79a17aabc", "comment": "Malware payload (Vidar)", "value": "4f6cadf56a2f12c4274738a634ed8e279ace4cc2a105f3b7afffd7e16a3dde9cf87ea7931e0f1e6f8aaaa40920293cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "e7c2ed9c-96bd-4e40-9820-76567b004984", "value": "T189829545E15B9AD9C4D5C332635611AB66FC7C202232AB3FABDC9B7A0D42730E7442ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "b22fc026-2dc9-407d-ba4c-efc300b53263", "value": "de4da189dce4a2df3103d8e87a228861", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "8a7ba40b-857a-4f91-b016-495e97cd85d3", "value": "384:OXc/Q3iA0PKKUA4ijzoxfpUVPQB7HbxiL+eOC0y+1wKCHRIlx0:8c/QAP9uUdQFbxiL7OChAwKCxOx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368820, "uuid": "44b55f12-0f3c-49ef-ab07-a97f8e4cc39d", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368820, "uuid": "30b5b468-a7eb-4292-9697-4b5727965030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "ae98380b-4d6f-4cf3-b7bb-8c11093b5d37", "value": "4c2dfdc57b9b008ab4922e6a37e3393f658adddd9469dc096d24fe4a84520114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc32f46-9471-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "86d53275-859e-4fd7-9d60-4dbc062ccf5a", "comment": "Malware payload", "value": "3e69ee6c9e9904930bc04411b76f1e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "db8b9f86-a33f-461f-8d30-0520c8108d38", "comment": "Malware payload", "value": "4c569b65106a60dcea42ac73ee32c15718af0f6fb7cca0f562c2db1413f2c2e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "11a4866e-6db9-4332-941c-32967de49ed2", "comment": "Malware payload", "value": "c821f254a17e3ee16250ede29100d2fa2a66301d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "0dd4d012-8c27-4928-8e7b-0d64b701ad6e", "comment": "Malware payload", "value": "09540fba729ab2a4f9ea476d81a5f3254ab9975c8750c28e17e999b88d1a8b82c6fe9c7caceb6042623367cba3cd1e69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335219, "uuid": "d54cb607-4283-4f41-ad61-6354a2a5bda9", "value": "T17163F823EE9179BBC40BDDB4466EC29204DB6CFAA3E5522A71F4169DBE7C30315C3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335219, "uuid": "908fd1ba-2f30-4cce-9e93-c14cd3cf97e4", "value": "768:x/IWLHEMQcYxBogghSkPt0lUkH/5y5aes0wMz12aFU84/5zR7:d9QckhghSk2bfksZ0Rx2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335219, "uuid": "e6e02f0d-cb63-4158-b581-54eeffe7731f", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335219, "uuid": "cba53570-dbbb-481e-86c3-81fd89cff736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335219, "uuid": "b027adb2-e633-4307-aa85-118613aa1d38", "value": "4c569b65106a60dcea42ac73ee32c15718af0f6fb7cca0f562c2db1413f2c2e8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1579c925-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "faad85d1-5837-4f82-8415-ce58fbe0ca15", "comment": "Malware payload (Vidar)", "value": "d82e38f335b56549a357c8922a1a49c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "13e72708-abe2-42b2-9c1c-247f8718cc1e", "comment": "Malware payload (Vidar)", "value": "4c61382ef2223b54d43612e22747edccb7991a35660e7eed6c149c4bcfba163e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "bb6a3695-b9a0-4363-9ee2-55a27c292bf4", "comment": "Malware payload (Vidar)", "value": "e7a1002fa659bb33d6b3e59d934df1d0646d42cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "e99bea49-7544-4e4a-9c5c-f82a812d09f4", "comment": "Malware payload (Vidar)", "value": "bbd4a00b21279f86cad2f192e1ce2758f500341e839308114684da4e13310edda06df73349b7e334dc8478499eed5749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "3a297c8e-a45e-4c4c-902e-87a1c0274be9", "value": "T147521A52B183F1BCD4A983B8DA5A267BCB20308417392FFF06ECC55567C2251A9B836D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "805d6ad5-2242-4d03-a987-14526cf0dd4b", "value": "9e59872e7b02a2d8c2cc19db69feafa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "3387f9ca-d95f-49f0-90c7-d3c17fb03116", "value": "384:O/ok7I7rG+nuRewEtfq8iwBrylfG/mlO:bgIXLubWfjFclvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368814, "uuid": "5f067671-9a16-4a83-8a43-9b7d841ff75d", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368814, "uuid": "e8d5661c-a5f5-4177-a82b-11a4428d4c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "757c876d-4d42-43db-bd48-822f0209a409", "value": "4c61382ef2223b54d43612e22747edccb7991a35660e7eed6c149c4bcfba163e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d027b-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "d8858ca7-d495-41cf-9057-fe1f07d2a264", "comment": "Malware payload (Formbook)", "value": "889b35545a9ffb3d9b5410e0b72dcbf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "96376b37-4637-47d9-a042-3ad7da1f4bb3", "comment": "Malware payload (Formbook)", "value": "4c8b29d0734ffb31f6811c8510aab950ae26ab49cff12bf8199933df10daa09d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "336c974b-c2af-41bf-a289-56c6a167c2b4", "comment": "Malware payload (Formbook)", "value": "4789d7e27873af76f5b8e23e35088c2202af196b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "0c4fbccd-10f2-4a30-9e5b-6ed4197cbd5e", "comment": "Malware payload (Formbook)", "value": "28ffa47543e9cfb8f67704080577d16fd5f66185a2b59a8b7aecce7e681ca2dd4177c897c583e0058d1698ef63bfe2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "b80ca6ec-056c-421b-ac71-8ed6ea659eaa", "value": "T10B2512A47BE5DF15D9A50BF90874C03043706EAEA066E306CDD5EEDBB42FB6254682C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "febdde30-4ef4-4e04-8e04-76fa2e87f2d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "01067ed8-2c5f-4297-9828-5bea90637eb2", "value": "24576:2j/Og31Iw3GpiEsjgnIefOf0NeCsQf0hC7EG8O4fw49oL:8Pl3EEvew0jH7iPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372303, "uuid": "bef3cbf0-73f0-46c5-b139-fd54b563506e", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372303, "uuid": "62901331-972b-4e8b-be4d-98fc4683f670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "124202d1-670c-4ea3-a779-8f3866b37e69", "value": "4c8b29d0734ffb31f6811c8510aab950ae26ab49cff12bf8199933df10daa09d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ae4f6e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "2cea6cf5-9e51-45fd-a8e4-67f853286317", "comment": "Malware payload (GuLoader)", "value": "ad3f54dc188882ed692b865923c19e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "ea4c515e-6034-482d-b796-e8117f6c228a", "comment": "Malware payload (GuLoader)", "value": "4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "23f9c608-9cee-42de-9993-f1e16fb8a0d3", "comment": "Malware payload (GuLoader)", "value": "7b1adc98fd65ba1221f9bfd1c6088a49ef081a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "a8c63dad-93a2-40a7-89a7-6643ce930e84", "comment": "Malware payload (GuLoader)", "value": "e9fa5f81958da802aa31c229f3b2ec4cf731f0172816077dd66df8c3844db0f41f613b796f809c9b1bb69e598987b7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "332fdd45-3b53-4f2d-8583-38710d865da4", "value": "T14F54CF2533B5E047E6923A31CE65E1F8A8196EA1ED1AE40733117F0FBD78F92DD49281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "244d0fd3-fd41-4a86-8e63-378807d31502", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "4eea29ff-6656-4a06-99b3-63c2c4fe2f5b", "value": "6144:Vbfopdha+pV8OJt1FQGYZVkFkMfNj0bKUK3voc:VbIc+p+O71FQJ4N0dSoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373944, "uuid": "53d82cb0-09e5-4dce-88e3-725544cb65bb", "value": 286704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373944, "uuid": "efd3b247-4baa-4edf-a9a6-1b5f72a0e819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "8c9bdb77-a74e-4c22-a424-50585e6d8e10", "value": "4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3103fecd-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "b35a393c-eb6a-4367-a7db-106bd633ae4f", "comment": "Malware payload (Formbook)", "value": "a9352ffbc427cabee5482eb91c00684a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "a7310748-92c8-40c6-9b56-607de2737b6b", "comment": "Malware payload (Formbook)", "value": "4d6e7f9441ab4ccd120dd621871c2f0dcd5d1a3679577fa0808c82b1cd434477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "a792dfc7-4e40-4d40-a8a8-01460a8d0785", "comment": "Malware payload (Formbook)", "value": "e4ad5357edc744354b1205462e1cd67d6d4fcf40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "b7ac1077-38de-4d21-9a21-b58cfb2b8261", "comment": "Malware payload (Formbook)", "value": "572efd447aefc4f5256a4ab2f3cb96337d6def2b18827214d5912eba82bbfd0cb1ec314f006a307ab5dcde303425dea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "a062a9d6-6233-49ca-93e6-7afe80d2922a", "value": "T1A13501C43B29B71EDE6409349539EEB542F91E68B110BAD32EDD7B477AAD201AC0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "14a4d162-1d1c-4672-9b03-43d1896929e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "a084836c-af85-4c9d-9067-f69d50e1e8ab", "value": "24576:F1BSNaKw000jb9BqybVlzQCbaDyVfKo2Hy4vAEeBXRNua4i1:FyVLVRBjwDRo2Hy4YoDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368430, "uuid": "e8e6e407-0b72-45b9-8d3c-1307250eec66", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368430, "uuid": "cefda9b0-ce14-433a-b912-567d6ed7c41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "c96fcb55-36ce-4888-ba6e-5f89611f4041", "value": "4d6e7f9441ab4ccd120dd621871c2f0dcd5d1a3679577fa0808c82b1cd434477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b31283-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "2d4b2e16-498e-4de3-9c34-d40895cacc7d", "comment": "Malware payload (GuLoader)", "value": "1c754ccbcd8b81e148b6bf1e8e1408fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "7b194a2b-2104-48f0-97fa-92e7fef415fe", "comment": "Malware payload (GuLoader)", "value": "4d88ce05409e52572b1e2b1e7471672f703472e410ad5b71c7fd13e6dafe01eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "e17eda5a-8b90-400b-a037-fbe1cf5c3640", "comment": "Malware payload (GuLoader)", "value": "052c6ddb0520d76e1c6005bef96e28e9e7e9638f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "9b6b4350-b3eb-457a-8dfc-57b50230f7f4", "comment": "Malware payload (GuLoader)", "value": "5783acfb53a4ef75d8b90ba0c965a2fe4c77edda2205df098182022bbcd59eff0982cfb5642e71751e4a6bee3193d996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "2b0f736a-5655-4815-91e5-b07eee85b46e", "value": "T17CD402C0E7409C32C6908975CECB86A6C7997717D0BB85F2FE70B95E687392219DBE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "67dc78c5-3d60-4120-adaf-fc22307e4437", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "8542c90a-1c4c-49cc-b40f-d3e530829f7b", "value": "12288:/TA580bdpG0uxWBn1R02Y43VKuEHV+nxTo8+sMX9dkmE2f0:/TA580bi0uxWF1R0P4lJLO8hmE28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373268, "uuid": "30569fa9-0551-41b0-b96c-63e5b445ff1a", "value": 612384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373268, "uuid": "f1914ad2-aab3-4447-83ba-dc8b3cb41a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "01f2442a-ba9e-43a1-80da-b9c942750787", "value": "4d88ce05409e52572b1e2b1e7471672f703472e410ad5b71c7fd13e6dafe01eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa696608-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "3ce58d8c-61ad-40b1-8388-a82a889975c9", "comment": "Malware payload (RemcosRAT)", "value": "78b70273fc590fab5bd01c8ea21363be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "ac6d5727-ce16-40bf-ae51-a9ae2bdcfefe", "comment": "Malware payload (RemcosRAT)", "value": "4da2425b6d3677ff80e52dd880a6f718257ad3c15deb565cd947b6f3aa05a9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "1c895027-0a7d-4441-8509-8badd50b0903", "comment": "Malware payload (RemcosRAT)", "value": "49cbf6c36dd5906bd73df3193d0f824e1664fbc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "4e78cdad-64c5-4213-b5c4-349bdab16cf8", "comment": "Malware payload (RemcosRAT)", "value": "cc260391bc158d39e0ef2dd91de1f36c1580bbcf58c4d096b4de8ea8255186a266f8d31a78f665215754ec05453f7f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "67f5c5cf-20df-4d01-82e0-bdd2063a1eb7", "value": "T18D26AEB1A3C4E5A5C41EDA34D730E233C1727D224A75908E198AF706EFB69527BFA701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "79e34fb4-8f78-475d-9f98-b12885679cdb", "value": "307f7e81c25ffd921ae92e385bccaf0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "c66f826a-c8c3-46f0-b205-d81f6f55299d", "value": "98304:iXLDad9OX3peer4RENS0WkIwHyEo1q8lSJBQwLOSnY3hO+WJMvJrfpMa/RE6GUkH:cLDavQ3pew4RtRgyH1q8o23hzWJ+h/Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372634, "uuid": "39ac5057-b7fc-42f8-8f5a-71eca855a898", "value": 4742144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372634, "uuid": "677aa9aa-72e4-4338-8ddc-7fb18f92a0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "c48354b0-534f-42cb-affc-7bdce9ad0998", "value": "4da2425b6d3677ff80e52dd880a6f718257ad3c15deb565cd947b6f3aa05a9eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76192c0d-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786371982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "95d6c10b-a8f1-47f0-b5ff-d6662a1d111d", "comment": "Malware payload (MassLogger)", "value": "266b6c12172e30c15ca9ce5461f4fb6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "31f92d4b-931f-40da-8aac-86480c2a42d4", "comment": "Malware payload (MassLogger)", "value": "4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "c7984b69-659e-40c7-aa5e-77e133209ad5", "comment": "Malware payload (MassLogger)", "value": "2da495c427eb233355b614d1a8e76252d7ccba5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "06417fe5-84f7-4188-9f3f-1a8bbca67a9f", "comment": "Malware payload (MassLogger)", "value": "dbe391336144dbb4b23cff1a7c0cdc235cc1d2bbd2ec72514ce2cc15c81668a0f36f9ef7293da636d321344fa51cdbc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "77a4ce8b-4c63-4dff-83d2-ac1f3ef207f8", "value": "T1DEE5AF46A3D40AE4D4E7DB30CA1A9733D2B1F86A0735974B0664C3462E77AA38F77325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "b124be1d-4501-4283-8258-cbf453963fa6", "value": "b0253ae8279600c3d8dc02919670baab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "95768104-4ca7-42d4-98f0-b2a937ae0dd2", "value": "49152:Fv0LbCUjseTJDNvbfdf+s6gFJXyQMg3qzdXOEh:y64UQrqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371982, "uuid": "cb4f6af2-164f-454c-b3fc-5ac0b0afab93", "value": 3257344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371982, "uuid": "7eb38cdc-c04e-4ee8-a91b-10a488128606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "fccf7ae1-6997-4501-810a-06900e80948d", "value": "4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ac88e2-9491-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "b4844739-ea4a-4dd4-82ac-a01cbada9d0c", "comment": "Malware payload", "value": "26caa5498a6ed8aba343f3e41654b21e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "3d0c60c8-497e-4e18-8349-db68d61f64f0", "comment": "Malware payload", "value": "4dc2369cb6796f275656d26663f6d7a238e080f438ad0c45b03edf1d3db5ecad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "fe7c1e69-b598-41c0-a627-0d4bf7da1d8d", "comment": "Malware payload", "value": "85b8a16954ed78b456022cfa30af3f16deacc78a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "dfdcb96f-b134-483f-9dc2-a0170084ec7a", "comment": "Malware payload", "value": "51bded65097f00f4f238dfbfa53bb22d8b0e1ec278148f7a71941dff25f8cc6af8cf7e438dc92124b9c663e2c59fe4e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348980, "uuid": "abfc7f10-1933-47ab-b93a-548ccc71bb07", "value": "T1D7C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348980, "uuid": "e6d46108-e1b4-4563-8a88-147b0a45fbea", "value": "768:g8vCB+25j6es8Rd9FYpMSUpi+20qUpi+20YQX:g8l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348980, "uuid": "2246a7fc-8839-4965-b6ed-94fe750f235a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348980, "uuid": "3d99d7b8-505e-4ce9-9f83-183259be7a05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348980, "uuid": "e66a85f9-6a98-471f-9178-69fc3c1f4b3b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8508299-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "4ff7760f-5a90-4542-b072-0c1c9abf19a1", "comment": "Malware payload (AsyncRAT)", "value": "8ecc789f830f03f365c4a05cb6ee3f10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "5c2b9004-94d3-4b55-95fd-c86276d42b8f", "comment": "Malware payload (AsyncRAT)", "value": "4dcd47adc6a3c061e6953153eb8b21511dd7c2c7d19968945521439c378a1a0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "6071beda-dce3-4e3a-9b9d-c75a3a2cf15e", "comment": "Malware payload (AsyncRAT)", "value": "2211fc6b7cb4f569863c1ea11e31fd0e73c54781", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "8cb10b03-87a0-4c0a-940f-a5ed465cce52", "comment": "Malware payload (AsyncRAT)", "value": "9b00519e14bd578f9c17b347ae72cd7d2d3b09d6569bdededa0992a05940be691c47eb45427b24ce9ef29c5f647698fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "79bc686a-506b-4047-b938-463f54ba321c", "value": "T13A150224B205E116C9996B340EB0F3B613F98EEEB502E2065FEDEDDF7926B014D15293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "8171d13c-df36-4218-917e-918c324b1948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "aea01a6b-acab-4e97-a896-c97ad6af0744", "value": "24576:PV/qfWNC4CvjvT5q6kgyQJLP2C6BtFgYV:om2jr5dkgN9P2C6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371315, "uuid": "c6534086-5b46-47cd-a541-8656fe65fb32", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371315, "uuid": "5654b3ab-65f9-4ded-8f44-47855ba2e110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "e0d2a7b5-eb8e-46ee-a128-0273334af1f2", "value": "4dcd47adc6a3c061e6953153eb8b21511dd7c2c7d19968945521439c378a1a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a115e388-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "7f2a970c-5d89-4385-b8f7-1384da9dd32e", "comment": "Malware payload (Mirai)", "value": "51de3e50a01f9703828c435d80d43d63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "96ce6606-14e6-44be-82c8-ba18853a6e16", "comment": "Malware payload (Mirai)", "value": "4e03e899954be97f141140e93d65a2c98878c29746951f618f08eac0a7229932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "b8ce8bc6-c84d-4207-bf2f-6a937264b86c", "comment": "Malware payload (Mirai)", "value": "bed3ed22e9ce2f3c14076c5e45060531a6959c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "b3acd1a3-0267-4fdf-b585-fca2158e00dd", "comment": "Malware payload (Mirai)", "value": "589aa45dddd792aa91da6c002094ac4c15c12e4ad160de84e83262f971c07ddad1ed0118b64e699069c0b2c84db5530c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383651, "uuid": "6b217f41-765b-4ba1-a074-85a9798dd8ba", "value": "T10034494B67608FE1E375D67006F38BA7A6E9269212D38545E37DDE007B6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383651, "uuid": "f7aa5ecd-af1f-4061-8164-efd1e6bb3db5", "value": "6144:/QUPVYr7IdHieFpsV2Qp8IS7Y6sDlGnTFbuiIgRk5:/QU9+eHgYkmTtni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383651, "uuid": "ca9e1637-6f60-4d40-9e9f-e89f4a69a120", "value": 249708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383651, "uuid": "bdbe7e5d-309d-4366-b032-40ae16276adf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383651, "uuid": "8ec8e576-3f24-46f6-9996-340c871c8e22", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314d630b-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786356834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "94df791b-1b2a-470c-ba07-d13156612068", "comment": "Malware payload", "value": "39d39de0a921c8a04a64abaf340c5778", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "842a4931-7694-49c1-8465-e736e4cdcfa6", "comment": "Malware payload", "value": "4ea56e5f8ded92fc09031d4554cd9911d0564793aa8ef3335b8c4a78e876e5f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "b395f5c3-c519-4078-92cf-fd763c2f6669", "comment": "Malware payload", "value": "4ca205b00be9f7d8c0bfd5b9232e2d8fada12800", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "deb31101-8d9b-4fe0-be64-efa388efeb99", "comment": "Malware payload", "value": "5d8cc4abab68f1405c5caeaa8c2ebe34bfe704c58fc5a91a91de096169bfd2249a65682fd2f4f9221299414db7fbba8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356834, "uuid": "3a91fd2f-8415-41dc-bf40-fe1c41d43f58", "value": "T1923188C92253CA752DE2AD2B72B9581579C890911DE0AE079CDD3CF4C0CCF64B286B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356834, "uuid": "049a5e67-8756-48ba-b541-0ad05ec15c03", "value": "48:i7Y3wY3g7YvYY7YV8Yy7Y8YU7YZYc7YoYNU7YrYc7YvYU7Y+YJG97YjYs7YCYY7H:i7Y3wY3g7YvYY7YiYy7Y8YU7YZYc7Yo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356834, "uuid": "ef37fdf8-38b5-4818-8423-642bd31721a7", "value": 1831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356834, "uuid": "d8f81ea2-b27e-466b-a919-75687288915e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356834, "uuid": "fe801a51-11fd-4536-87c0-2d043993b83c", "value": "0x83911d24Fx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389ff2a0-94ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786395931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "28ed1654-ae7d-4bfe-bb97-01e69dd8a97e", "comment": "Malware payload (Mirai)", "value": "b486d3c9ff8a06738ef7551b51c68a12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "ce24a1ac-8bc2-4c5b-87c2-63bb350c0cde", "comment": "Malware payload (Mirai)", "value": "4ec1e7e5178b590c41ff1b14c79674749152976ac338d8f71761d0e5e26a73fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "4f5bfcfc-0354-42b9-96c5-44ef460b53f4", "comment": "Malware payload (Mirai)", "value": "d6fa8ea8167efc062e94a01c14a7bf3d4ce78aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "15eeb3ea-ffc6-4297-85c7-38982398bfb7", "comment": "Malware payload (Mirai)", "value": "45e951be5f6ceff8f4e3d3a9aa2ca661d6143a54d47e6e4ba635afe67ba1ec1985e6766c3ad5bdea910a809fa6baa492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395931, "uuid": "a928ca60-86cc-4729-978c-d05256315fbd", "value": "T16F935B89F783E0F0D94605B1116BF73E8735DE225024DE5ADB94FE76AC32A02E61A71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395931, "uuid": "514490bf-4af8-47b3-915b-4e95170661e1", "value": "1536:Ady4e3iSuz2OcLa/MS8l5KXVll0qjMOUF31s49owxqJl99xoZFQVur:Ady4e3bh0/MSa5OVll05+BwKecVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395931, "uuid": "92568e30-2f5a-4150-84ef-d23a51361041", "value": 94972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395931, "uuid": "b93cc1a3-8a5a-4002-863b-3318664e937a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395931, "uuid": "6d1c5b7a-7faa-4f50-9a49-1654bea64f63", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd94d4d-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "d1c66c2b-fcad-4e22-9b21-f8cb812be84e", "comment": "Malware payload", "value": "d5c1d48f4f0f8de99d4f18859cd351aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "dccba6aa-5317-4fb1-9a01-c57b951edddf", "comment": "Malware payload", "value": "4f3769f20a26052921f7b6a50f0e6954f0faaa25ade2197b889e161184cacc8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "0ebcfcc0-7b7a-4e7d-af02-6c90ceda6c45", "comment": "Malware payload", "value": "55582df4a82bbdfc25915713214a43e9ca7accc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "767ed342-2809-4f27-ad6d-346eea07a055", "comment": "Malware payload", "value": "87a49bb998f4f3627ee715021397f386dc997ed50104a9dac5c5422bc91735b78b82e8863e3af3b73370bbb4eb8a0279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395775, "uuid": "80a07dec-d5f3-404c-a0b3-7e39ebd00114", "value": "T168636CA9ED0E7941E2D5E335EB594BE1A12F3DB0C35680B37902718DC4EDADD8ED2205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395775, "uuid": "3f015ff8-55a1-4390-a476-4388bb06950b", "value": "1536:4qZmrwnI6HkNAASAlKHcXUWFIaQRjJDVUrO:wYkSdAc8XUWFIaQzDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395775, "uuid": "09c365e7-acf2-4951-92db-0f04dd0a1d5f", "value": 70720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395775, "uuid": "b5dd0fce-0b0a-46c3-afa2-5eaeb3e20c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395775, "uuid": "89c3fabc-98cf-4e83-b6aa-fd043b6178ff", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f5f053-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "de0dfac9-878b-4cc1-805f-2fe417f6ff68", "comment": "Malware payload", "value": "9718d7ddecd0efc7c1951520a83064dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "a215bcfd-95b0-4fff-a42d-e171929e1212", "comment": "Malware payload", "value": "4f4d5c28ac76d77d4db7fad4d369ba245d8d0e5436c080ae03bf70ccfbd0e502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "51e76a1d-7525-4837-87f5-e2ff5454fe54", "comment": "Malware payload", "value": "d83f7b6d5dbe3f0230c3e2c8a8f9f8bd3cd07ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "f8399431-25e6-4fc3-ad27-7210e1a85535", "comment": "Malware payload", "value": "c63562cb203b010a73ecc2f7e06725c42c8b23b8348814af7f1da4546bc055d18879acb20f94a5c499bc91f0353a44b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "e468bdc5-d67b-4028-b2b6-189cb86f9ce3", "value": "T18015023D5D8FAF52C97C0FBE806A45D82BF4C9079252E7272EE901F88F573E55862092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "14a9e361-2a48-4a5b-a160-ff9d4cbb11df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "dc7f7600-360e-4ecd-aaf5-8a7ff51990a8", "value": "12288:qM1FLKi/251339JCzll10/MLR/3a5py7okCmVALeuFWrcaW5lkQvddbY3kx:qMaie513NJC5HPxaXy1VALNUSTkQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369224, "uuid": "79ac8d06-8fc4-4b9b-a73c-39a19f957251", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369224, "uuid": "3ade8bb7-afb1-418e-b9b3-43a895bf3ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "6ccf6a23-81a7-498a-8772-d2b8a738f516", "value": "4f4d5c28ac76d77d4db7fad4d369ba245d8d0e5436c080ae03bf70ccfbd0e502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447171ce-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Tofsee)", "timestamp": 1786372328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "111d80bf-e5e2-4b7c-9a98-9374e956ec5e", "comment": "Malware payload (Tofsee)", "value": "fdf568de03be77fc258a7fc289cb95d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "ff7358f6-5215-426e-9afa-94cdc4e238da", "comment": "Malware payload (Tofsee)", "value": "4f4e1a4365a05565a07191af5b40cd40a08d8639ab17c1218bb53d74f0a1e513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "6116d43b-f470-4b28-b031-e324e77ca224", "comment": "Malware payload (Tofsee)", "value": "74508edab82dcb241750f4f2c6447bfc8a547137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "b19f96de-4a40-41d9-a79f-b98b47369a31", "comment": "Malware payload (Tofsee)", "value": "eba03b80417125dbfed607d0a138f9112295396245bcb482f02f6cc424816fac1956031856416712a7ee0a6a69c0044e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "4cbf5e83-e0c9-4354-ba9a-9ceb2b3c4a7e", "value": "T104E60133B24B653DE02E16396D7A9122543B6E71BD224E0F96E034ACCF3D1607DBA647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "e3f7ef23-0bc2-4621-81cc-f75764d4719d", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "f8aea408-3a15-4383-8661-b2a8582142f3", "value": "98304:EoJJqAluMjYszPgfcaEt2bmpRgrYVNljQ:HTlXUfbEt2frYVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372328, "uuid": "1c6786bb-6b32-4fa8-8388-f87aace27e1e", "value": 14526282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372328, "uuid": "a640ef23-92c1-4f0c-a889-78a161a1be76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "9e4e5602-c4ab-40bf-b3d7-c05144f75b9b", "value": "4f4e1a4365a05565a07191af5b40cd40a08d8639ab17c1218bb53d74f0a1e513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7434d0e4-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "f32e732a-09f0-419f-bf0a-4c80f38ed551", "comment": "Malware payload (Formbook)", "value": "55c5b8b7e155fb84cd169daa92eb58c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "d18bfc0d-5d6d-496e-93dc-c68c4473f1cd", "comment": "Malware payload (Formbook)", "value": "4f6eee9151521e78b72771738e7c5fb87d642a8fbb1ade70ba9710ceb4692aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "a7c95f0e-0968-473e-b82f-564fe172f32c", "comment": "Malware payload (Formbook)", "value": "671b4d9e1e5011be0f970ef46bcdc3f38911a1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "9428bd12-1f63-472c-9068-7ec7cb076ea7", "comment": "Malware payload (Formbook)", "value": "6c1f6ad3e79265fd3e46f03bc9ad72bf439e1ad769c1a43db0b4f8dc88269bf624bb32df8fcee558a5c0d01bbadcb2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "4f7d409d-cfaf-46f9-ad19-4271c277c183", "value": "T17E3502592668CB06E4B74BF48972D2B447792EEDF822C20B5FD83EDFB83A7515100792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "017c231f-c489-44bc-8b70-eb5738678847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "b44b26b1-ed45-471d-b953-ef7b97ef55a6", "value": "24576:Za6Uwy9TWyx9G4ufdQbjBsZpPSwbPCN20EqVjxGg0:Za69oTWyDG4SdQfBsHPfPOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368972, "uuid": "359a6524-8f35-409b-944b-0e7c200938ad", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368972, "uuid": "bd9a3862-7e9f-4984-99cb-663e2ca10810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "27787a4e-c2f5-46d1-a1e3-d7261d37e132", "value": "4f6eee9151521e78b72771738e7c5fb87d642a8fbb1ade70ba9710ceb4692aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e407e71-94fa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786393793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "922a6649-57e5-472f-b6af-581796f7d0d8", "comment": "Malware payload", "value": "dce19b87c0a28ce08ce0d83a05a32603", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "757d5f96-02fb-42bb-9703-eae72cb0ab09", "comment": "Malware payload", "value": "4f75ade0a9e46456e8380ad3e4df9d8619c117fb21e885cc56f84b5cdf01fdd2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "a1171f99-0276-4fa1-a41b-334456592afb", "comment": "Malware payload", "value": "54c594ca3972bf7c9192968e455fdb73cd53fee1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "40ff605f-1ab3-4b85-a933-934636f93270", "comment": "Malware payload", "value": "f56875bd1d380c7cdfb5082a6af4a2f2aca7bd91b35b40d4a1ea4ef4f4264244c90d42cfa13915b0f299fb2decd78362", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786393793, "uuid": "3b825c1d-6563-4bc2-9f2f-3313a255cec1", "value": "T195C28D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324D42AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786393793, "uuid": "3257b7cf-5348-49fd-9a50-dd4adee39cd8", "value": "768:98vCB+25j6es8RLH9FYpMSUpi+20qUpi+20YQX:98l25JNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786393793, "uuid": "8949b23c-3b46-4cc6-96fa-14b3cb77a7ed", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786393793, "uuid": "9aad7dc7-7a4b-4755-8847-e9358254a57e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786393793, "uuid": "e6f51061-6043-4a13-bfe7-a0493fd47db4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf39651d-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "3e400e2e-5e77-4b4d-bd51-13bd1b8751bf", "comment": "Malware payload (Vidar)", "value": "89e1c40de9b8d7533e9b6dcf1b72154d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "31e96f86-cd89-4145-bfc8-00a8bb24d369", "comment": "Malware payload (Vidar)", "value": "4fa82520da2885d66bfc4a58bf9db0b89822d0fbda2036f57426928308d903d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "dcf782c6-5363-4968-b5de-2783faed3ce9", "comment": "Malware payload (Vidar)", "value": "f33cf6bf6a5043b8f4d910481ceb29edab4ebf8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "0c11ee07-eca1-47bc-8103-6baa185d0e80", "comment": "Malware payload (Vidar)", "value": "197e8dad6fa636391e0a22290ea6bc4e59c076306d45976bc7253feebf526d70111e64a3828ff6ba5e521fa1caf8db1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "6c937c4b-45fe-4bf4-a5d9-d7711ab7a868", "value": "T121F58B177CD049F5C0A9A331C9A24282B775BC490B3573DB2EA0BB782E727D19D3AB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "4bb77799-8f5a-41dd-8173-4b2381072d05", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "d67ba045-c6ad-44bf-9154-e94e6ae571aa", "value": "49152:uG0d+dg1QsMlxlDAMhOqyzxRKM/T6DtoSVud2s9FsdAd3yZ+TQ:uGcixzcKM/mg2s9Fsda8QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372561, "uuid": "00ae40d8-f8a0-4da6-8050-aef24bc039a1", "value": 3463520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372561, "uuid": "55ffe2a3-3b36-48a4-97f1-cba55a4d1ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "b1d50751-ba40-491e-af2d-b027c03146f8", "value": "4fa82520da2885d66bfc4a58bf9db0b89822d0fbda2036f57426928308d903d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b714db14-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786345892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "40f7cf25-8feb-415f-9b4e-89d2e2ae4dd4", "comment": "Malware payload (Formbook)", "value": "7e7dd3809fb57309826d9a79c40d1241", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "5242ac5d-f2a4-4e21-a5c0-bf7268e4c326", "comment": "Malware payload (Formbook)", "value": "5013e61d66b8bddda613be42e2f3b3aacc6abd7159f54cd6b4d900da8e8dd404", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "925f80fb-e5ca-4df7-84ef-a31b15e69fdb", "comment": "Malware payload (Formbook)", "value": "09030be0d89d068b10dc93f4a3c0485b18c47011", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "7c560825-0a84-4bf3-9a6a-871ea4cf43f3", "comment": "Malware payload (Formbook)", "value": "60d379a84d4f74ddec03e3a0201683126312e2a96e777d598fac6e8d54fcbb4b0aad8ba52c00872acba666b03ab4a402", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345892, "uuid": "f8ace194-37e4-452d-b8b8-9e4d65adb9a5", "value": "T1BB53204495C379845333BBBFB62798E4E276076B01804A1BB87C7851AFF1D19DEE08B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345892, "uuid": "598bcbc3-5ac1-453e-8d02-39cdfcc0dc55", "value": "768:V6moRddz6eaJN6vFT9vSvWEz+TfKCd1gR8lCuntK0FB/CkzSFJX9W9L8tcRlT9h9:4mUdwRp4R0Sm3qHwiJPLQJCW6Oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345892, "uuid": "8f77214a-d456-4210-a2eb-1751c59fc76a", "value": 65144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345892, "uuid": "11f485e4-dfca-4a74-b68a-e9fcd4badc77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345892, "uuid": "0324231c-6b4f-47a0-a363-b9c5ea0bc791", "value": "REQUEST FOR QUOTATION BALL VALVE (PCMSB P1TA19] RFP-000000186514- (PCM TA19 FH-SBH28-26274).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58d6bdd-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "486b9ccb-8482-4bc1-b827-9323e5375495", "comment": "Malware payload (Vidar)", "value": "1b9017f8899eb7c9c26e03b0b31f25a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "eda79193-8278-4da3-bc5d-a69d11efdf09", "comment": "Malware payload (Vidar)", "value": "504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "d7553c4d-0e0d-47b2-8a54-4ce45091657f", "comment": "Malware payload (Vidar)", "value": "36fcc12316b1f63faadf0d580f4de9066024da14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "5a4b0c60-3f90-4166-a30d-5266c4b51a05", "comment": "Malware payload (Vidar)", "value": "a1448e1301ffad3ce77012d90424a3017e130dd1193328e5f5625fbfc41a04a18234998f4cfd2e0cbcd8565d8492ab21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "55b0ffff-f8a2-4deb-8f20-d92d7c71e9ab", "value": "T1CB52F88BB2C325EAD169C3BDC9892396E7263094031E5FFF4DECC4AC769225025B8775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "93721ada-05a8-4a76-b25a-1901e51d754f", "value": "1599d6927d08f88e02098ee396f7c0e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "8ef75051-7f03-4f2f-bb22-bfeeb5c41513", "value": "192:OEhwpVs+EOA3idOx+6tt2J3BI8mIA5kwXoOf/Fhke3VJV:OKExd36+BI8mHkwXTf/FnlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370881, "uuid": "00504822-9475-442e-a9ae-ac341a7eed8d", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370881, "uuid": "a8c949c6-2a9f-40b8-93e6-b732751210b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "68085420-3924-4663-8fe7-0c6f4e229173", "value": "504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3616a17-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "b46213c4-f108-480a-b0c2-8f8329cb4a7f", "comment": "Malware payload (AgentTesla)", "value": "4bf9a9e9707fe32320654e641adf62e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "48cfd323-a051-421b-8fb5-ba212e290968", "comment": "Malware payload (AgentTesla)", "value": "5069364f9e57856f2964c98fabfc09391f604c2a8a0136b2e486896b1d02e9b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "6e8063c8-e4f5-46d4-90d5-5ee4737cd8e3", "comment": "Malware payload (AgentTesla)", "value": "c8d77388cab373eebdfff42be7ec4a9fcce7bbe5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "eee2b562-d64c-4fae-96ca-3fff7aebeed6", "comment": "Malware payload (AgentTesla)", "value": "643bbe7596255365fc9829192abfa0a746224c8830474b248db9b5325a9c8fbd434753c3f914fd8ce494bb420ff7c039", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "a0bd7ba9-6e95-41bb-8d81-8a560481f3e1", "value": "T1812501541356DE02D1D69BF6AD60D77033A90DCFB9D2C3926FE62FFB781A3801858682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "1f765508-69cf-4f57-8d2a-b1abb2d0d8b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "b37aa0e2-ec23-4dce-9f0c-d767a2b65461", "value": "24576:Zyop5038YDQmy6aqZG64sCe1WL/4shUE3k6Tnv+O:7pfYQmyVjshELwP8Tv+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373024, "uuid": "62511601-bf8b-4042-9feb-a7f59c4ac074", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373024, "uuid": "177071b9-0dfc-4403-bf48-664da92c2386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "1d1ddb11-2266-4cd8-961f-1a6e701f917b", "value": "5069364f9e57856f2964c98fabfc09391f604c2a8a0136b2e486896b1d02e9b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db45c622-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "a9dfa106-e1be-450e-93f3-80d165e7f4b2", "comment": "Malware payload (AgentTesla)", "value": "a8b5413fc8d0d4e9f3c634fca19ff5c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "622cae08-66ad-4a9c-921b-8be45cf3d035", "comment": "Malware payload (AgentTesla)", "value": "509b69fdf4262c2fedae688ca4645021391ed1f395e62faa398d52da8b1ce080", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "aa2a2ef0-513d-43f3-8824-1df9dc5bd344", "comment": "Malware payload (AgentTesla)", "value": "c90588d4f37291a0adc36385e6012580fc60cd04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "6e9d4d68-71b6-4db5-ba68-b9d349d2ee55", "comment": "Malware payload (AgentTesla)", "value": "0d1678314f8e65c70aa25297f3ba3bd62b987b3e2444bd27e47ab9862515f1f6efaf8f6f3dd95b1d6b937d4e5f342b47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "7b79ac67-6239-4f73-811b-752123f882e9", "value": "T158D5BE55A3D865E9D466CB348B15A232C2B27D634B75E08F0A8AF3061F779924F3F702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "f0831a8d-2ca2-41b5-9016-f13cf9dd7e77", "value": "592f2a4e38c27b54ff57db9c30b12a37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "5e887790-701b-43a6-8f62-303c70cb069c", "value": "49152:gn0H3utg0VfbSarFvELIjyFo12MzbYjmO3UGCxb+3qyF5IUAHu9ShrD70C+sW:0tg2fuaejmO3UGCxb+3qyF5IUAHu9Shw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372581, "uuid": "a7aad386-954c-4b17-a0df-51130f5eca37", "value": 2946048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372581, "uuid": "014f4168-b738-469a-97dc-277c4bb39732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "a43409da-eef2-479f-b350-eb3fd5102dac", "value": "509b69fdf4262c2fedae688ca4645021391ed1f395e62faa398d52da8b1ce080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d439ad4e-94f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786389749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "8ccc098a-3c87-4ee1-a138-5dea3bccd943", "comment": "Malware payload", "value": "c9e10385ff907f6d02816e20447124fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "d6855318-9281-4f2c-ad2f-016e2d037429", "comment": "Malware payload", "value": "50cbc41dd30defda87d6639d231c4e9c3f646c9a5a172175f37249bfd04cd1f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "8328a15a-87ca-46c4-b929-5affc12fb591", "comment": "Malware payload", "value": "f7e4d179bb05ffa903cf37de6bb0cdfddea7a4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "f465225e-8eb4-4ce3-b468-fd15ae3b1dc3", "comment": "Malware payload", "value": "3b64f2f991f76e993de85dc401bbf217ce8b62c5e7b59109e12c9c59b7e792123ce6fc2daf22c23a1e72b7569e1d9750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "c48e6b49-2e6b-4f44-9f81-a93334942dff", "value": "T100369E23B384A53EE4671E3A687FA649583F7A203A168D476BF40D5C4F396402D3B787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "b047c1c7-0e54-453a-bffe-2b270079f993", "value": "f6536c1d8abf1c4fa74c317ac43b14e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "ab293fea-f42d-4471-af48-55e33121de83", "value": "49152:Op1m50HttLVQWN2SIc3TS3UDhhv2Wn+F+KMmbyR7xYTG2sjMM3RQJhS333E4F:OvdHRh7Vhv2Wn+FYGa7xP2gRQJhS333T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389749, "uuid": "04ac6da3-8387-4a39-b653-2256f866835d", "value": 5092864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389749, "uuid": "80d2e09c-2257-495d-9605-481ad45287d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "c3a014ec-4eb2-41d0-9158-f8b09d33a40f", "value": "rq3w037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b59b0d-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "1c0e211c-655e-4749-b2c4-c499514d5587", "comment": "Malware payload", "value": "b91f2918dd94a02b3fb7166204f33255", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "0b217e6a-3269-40f1-95a5-2209e4ec24bc", "comment": "Malware payload", "value": "50ee481e238a2b5719f66d41b7ce40ec0e791e34e3e0cba3bbd97a994401435d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "88cc2024-b1b9-4748-bde4-e9ad4f98bf71", "comment": "Malware payload", "value": "7dd9bbeca2490748f8aaa37e92e316a34bf16632", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "73b0603f-cee2-48ad-a58e-5bef35e8c019", "comment": "Malware payload", "value": "8b2e6453b6159e112d8379a300c8ea7b31873e2b8e1269a6e8aab2142bef4e96fa91110a06977f1077e8c8820d559cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329705, "uuid": "42c6de27-5e3f-4dbc-8b2d-100d9529a5d6", "value": "T1EE530911EF0CA817C9666635A5372BA9F3A0B8D11170CD12B3053B6F16F3636AC87F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329705, "uuid": "ad6043ce-159a-4dd5-a62c-bbdd0b1681f5", "value": "1536:OCCfQZxXyV4NuVfLKO0FA5iThON3sPAXgS7zwOmSpOcoF:OCCfkyVNKO0FA5im8PAXgIwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329705, "uuid": "d553d61b-66b1-43ab-bacb-2ad09bf0562e", "value": 66616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329705, "uuid": "d3f78186-7c9d-4ab5-a9f9-a4ce18b7fa16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329705, "uuid": "ec4ecd8d-ba3e-4e93-a955-5d032048dead", "value": "main.e6500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80f3600-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "00c62610-e202-471b-b169-af4889954742", "comment": "Malware payload (Formbook)", "value": "dec15a68f345ae5b818a1acb3317e5a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "a91730bf-a526-4b88-bbfd-bbd84ca4fb23", "comment": "Malware payload (Formbook)", "value": "511a8b81004d154c5232886ddda3aebb6387a503d695dee31d1094ad85f461f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "3f13ae6a-a7e4-4caf-a703-b17add02887d", "comment": "Malware payload (Formbook)", "value": "9653cf84f1155979719aecc68980689ec16af605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "b7e22a02-5ea5-459b-9ac1-99ce96594081", "comment": "Malware payload (Formbook)", "value": "731e6026b022d26f1881b13425567a2a8088691f4456455a0d2d72f99048f89d3e544841b6ab521b89f8bfc08ae06417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "ab4e97c3-851c-49a3-9cdd-b6cd4230494e", "value": "T16C2523A6BBD2CA26C3C60B700D75DEB913B43DDDE961D3138BE8ECDB7560A603955220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "906a1163-b933-4217-9346-bf354523a733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "559cc495-dc7a-4539-b8f8-54b4898987a5", "value": "24576:+j/Og3f3JWRPzLWYc9DvtYrbKmOkztFZbOo3qDuxZgXCEHCtRCK:UPhAmYc9D2rbVOkZXOo3qwZugR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372066, "uuid": "7731262b-8bcd-4dd1-a85f-573a1e8b7d78", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372066, "uuid": "e629d8e6-5930-41ad-98f1-cf32d7aef6d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "d2993668-273f-45da-a085-edb5e89ce81c", "value": "511a8b81004d154c5232886ddda3aebb6387a503d695dee31d1094ad85f461f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8ec4cb-94d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786377150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "b23b4904-0ee0-4c38-b09d-26621a1839c8", "comment": "Malware payload (Efimer)", "value": "1a17595d3bb3a2b24d2fa35e4d6fc7c5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "1c46c3f3-131f-43d2-9da9-d934bf0fdcb4", "comment": "Malware payload (Efimer)", "value": "5135843d806f71c346f1ad4fb9bb283f8667d4487782a8667cf38afb3fccfc7e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "0d3a1656-5d4a-4933-bab3-e0811e9c13a2", "comment": "Malware payload (Efimer)", "value": "8fbd4c645cec835d3502fd8f5b63eaf3cbbdaedd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "210b7513-d5ad-4ecf-9e0b-0b450a765e92", "comment": "Malware payload (Efimer)", "value": "6f6ce328a86016e84b52ad3ad1d0d464690167f78103b356920f000af325dbe3285d045f6fb094e196c8aada8c83d659", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "a60f1dfa-8336-4b06-925f-3d9f02751d07", "value": "T103E6334C2AE002FDE9A3B93CEAF2069AF4717CA21B34D9D7CBB841465E131C05EB9557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "461a70a6-e2ee-4759-b8ec-63506af61781", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "9ce9f678-6946-4564-94a4-e8e1af1543da", "value": "196608:SVVBZPJe7EyFmXRqquDJE7Fid7p9g66rCeMXMCHGLLc54i1wN+MoPIcu9KYK39sm:SVPbXoFKA9DXMCHWUjycuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786377150, "uuid": "959991f3-0cbc-4d76-903e-166ef8416af6", "value": 14060327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786377150, "uuid": "0bc85a2d-9c1b-41a5-bdcc-89f125ef5fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "9c3b6fd6-59f0-48f9-a6af-b4d404889c9c", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f124b168-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "21754b12-88f7-4f60-b796-872181e3d313", "comment": "Malware payload (Vidar)", "value": "da58e7235489bca05f4fa5fd175f061c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "0fc22feb-be07-40e0-8a41-2079c9c54a61", "comment": "Malware payload (Vidar)", "value": "5139207fbf60b152f4bf99a45889703799b14ef1be7471db86d92298dab4dc09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "ce41cb77-bf2a-43db-b05a-b58a0214ba21", "comment": "Malware payload (Vidar)", "value": "ccd0ac8065f224b4491c5b50eea0de84b0db1afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "4fa7fd55-c585-4e44-83ec-86c7b7cffda7", "comment": "Malware payload (Vidar)", "value": "a84bb106358f3a32dd92256abc6a97129b3fe4a9b57e923d7af2f1691bf41ae97ececcd94b98dc74817fcfd7c8635a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "3dbe1973-9e2a-44d0-8df0-c37cde47a3af", "value": "T17A522BCAB1C361F4C0EDC37D8B5A12B7D6A6744113275BFF4BDC84B46EC1222A468A64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "c3e20327-c55d-40df-a9b7-e52cba7cac62", "value": "7f929b6102d2ed98f1e08cd46c6b439c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "63ed7ffb-989e-4c33-968e-c5e46cc04b89", "value": "192:OfTa5iYkl5i7olACK4p0AbaqeCUKXRso/Msr+lz3VT+6p:OfTa0YklAUl44qAb4TKX+o/MsylT+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370900, "uuid": "0ee14db2-8619-4bc7-a437-5ada5cd53e89", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370900, "uuid": "ab6a9812-f318-457c-bfe2-de4c2ef72fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "4bfb7665-f81a-40ab-92d5-8464d4786c10", "value": "5139207fbf60b152f4bf99a45889703799b14ef1be7471db86d92298dab4dc09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aec43e-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "07cb8939-e329-48f6-a42a-9e06d3c43d7a", "comment": "Malware payload", "value": "e492d127979d24d58947f9a607c03945", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "b64ecc6e-de97-491d-95e1-724028f98e1a", "comment": "Malware payload", "value": "51747e279a0f713ede309e044460188f38e93b2c9c2bcd4f73638492cd26ffcf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "1d92e689-7390-4643-a5b6-56bc7203f2a4", "comment": "Malware payload", "value": "205366f55e9880997b40a136d4eb683caea8366e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "88f615ea-a9b3-4840-9a47-971116e54e08", "comment": "Malware payload", "value": "e6102cef7f2e518a378a14e73c8eec9d1b09378d8404dc2dc284a983d8bba7fb80cc360eca70545f33050ba747cc72ee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372522, "uuid": "8ad1dac3-db68-486b-80c2-285c7d409b41", "value": "T169315ECF10201A311042CA9E7BF73189B58EA1EB2D8FC3D498591EA993897CCF651F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372522, "uuid": "418e1a3e-e696-4506-9af1-367addab57a3", "value": "12:UU60DPclI6clC39VDb6KEWe0GBk6BNGF176F59cqFb6FKWpDR6DFSo6FS6OW6OpD:I2C39lEWe0ElMiiZYVc2aGAXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372522, "uuid": "f12cc449-9b7e-4cb1-9090-11c35cd75823", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372522, "uuid": "975f2d77-691f-4790-a6bd-a1200c4020b4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372522, "uuid": "3e956c0d-caff-4ec0-87b0-83e0ff1fde5a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbb0bbb-9468-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786331377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "3c2b07c9-5b43-495d-b76e-a6784c678ca4", "comment": "Malware payload", "value": "0c07475851a9329d988f0059bdf160fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "d4114eea-77e6-4ee5-abd3-c3c4ad20c589", "comment": "Malware payload", "value": "51e42cb2dd6ec6d9cf808eeda2cc6fa5cf8201e9e0e92345655368a9afae7edb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "3194d5e9-b112-4680-b002-3ab692653a54", "comment": "Malware payload", "value": "0cb1ad9633352b3d8eed4fe8af41514756867edd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "9b15e35d-890b-4f22-a435-737857cd4362", "comment": "Malware payload", "value": "84820f29c56b698a8b71a190ec729db5c37266d92498a70c89c02adbaf460f8556f47470554d30bec28b679976bed25f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331377, "uuid": "c77d1376-a452-46b3-9d21-885a2b7aa421", "value": "T1C5B62347FA405F97C9A9417988D2C7B163F6E208E64247233BD89728FCBF2615F99C81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331377, "uuid": "35a14a83-afb7-4a05-a2d7-f768ab20496d", "value": "196608:dIvRNiY2tvHgwwa++T4jspYro3UNdqpri2sM5msk7xO7tpDjOAgnn:dIvRNUBy+T4j+kKY2f5MO7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786331377, "uuid": "ec2578e2-5662-4ac6-a1a5-5c4395877790", "value": 11131211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786331377, "uuid": "e8770f6c-6fde-4730-8547-756934ae6664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331377, "uuid": "61602ebb-5859-4116-ae1b-406774ea738b", "value": "promocioni3.php.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d7f002-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "fedd51be-7cbd-4b24-bcf6-4a3a34eebdaa", "comment": "Malware payload (AsyncRAT)", "value": "cd6fa053ba911751efa2f530ef7ad13a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "141ea353-579f-4409-98d6-935d1202c7cf", "comment": "Malware payload (AsyncRAT)", "value": "5221f853cf61822c1e01fc25090a6599646c8430e5ad0858b405e46a3524b487", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "d0ca6c43-a0c0-4335-86b8-7d2ea6e4c84d", "comment": "Malware payload (AsyncRAT)", "value": "7c522d891eb1f468464e8bbbe9d3a57afa8800b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "36c8afe2-f34a-4167-b06d-06af9010fa6e", "comment": "Malware payload (AsyncRAT)", "value": "4c828382b2e83418ae08069f0218227471de921f83c2667c07cc3cb5b0ba2db19c7f785ab06c5c0f03a611552f6dac31", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "fa0c99d6-9cd4-4512-8306-b0e302c9a733", "value": "T1BDF41259AA85DA07C15213345A66F37822BC2DE9EC00D7239FDE9DFFBA36E148D041C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "746a25d3-cca7-4ef0-b55d-14b23bf1e3c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "5dc342a6-7463-4ffe-906e-c9f0b6e8fcb9", "value": "12288:PlJdbnZ5uWIOAunM1ckpvt4vwH4CilII5sUUsGbm74kLziak94/PU:PhZ5XDAGAvevwH4CilIbUxkm74tJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371767, "uuid": "7469f9a2-7a65-41de-9ee2-4a6be50116a2", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371767, "uuid": "93e999aa-c4c6-4a48-93ee-2cc7ea6d3a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "1e03587d-df13-49fe-8cf2-faf6bb3a761a", "value": "5221f853cf61822c1e01fc25090a6599646c8430e5ad0858b405e46a3524b487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e7021a-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786396844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "4a51cd81-fd1d-4000-b5d7-0eea26147abd", "comment": "Malware payload", "value": "ffa76204740c899157a5062f46fdecaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "107ca33e-584b-4845-889c-b13526dc2f17", "comment": "Malware payload", "value": "5243e3702046dbe5d8ca9dd72c99df682d6637964adb4341e1a9a3394305e1f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "4d78bd44-9afd-4314-b409-08b5da9561f3", "comment": "Malware payload", "value": "04d5695fc1cae6f6bf044e816f3045430436bc60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "7a4c67a2-f82a-4001-b09d-8ace2da4ef1a", "comment": "Malware payload", "value": "5e835aa7d11a6725cec939f3b418abf1e0c4491232f2a053d903a78c4bc67b0d352f6bf85353dc1844a1c65e5a31ea73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396844, "uuid": "e04fd09e-60b6-4f68-abac-a0b434ba5b70", "value": "T15FD35B33B70A9F63C63D52B54EF2CA3996E1265109E2A1956312DF0C7E312687C3EDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396844, "uuid": "a6ca2dab-eab5-40ac-b488-84681a388861", "value": "1536:mU25TadM5aYTha4Jr2u4A+qiOnPX3MUDL1Sts5XzERQWWEyRFZ3d+rrFS2:cFaGr2RdDOP8UDLigXzAWP3wfFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396844, "uuid": "32155907-3bf3-40ef-ba01-f5f03eb94cea", "value": 140296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396844, "uuid": "097489da-4710-4477-9c72-44d7e3d48eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396844, "uuid": "c447d9ae-8781-40fb-b890-a47b42ac573d", "value": "main.mips64-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0900b72f-945e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786326702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "9941c4c5-1a51-43a7-828b-8d5bcff308d0", "comment": "Malware payload", "value": "12cd6a23db52223662a5a098ceaf0f02", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "b0f76b0c-cd0d-4bc4-b9bf-edef73a0724d", "comment": "Malware payload", "value": "5252a88bf7cdf43210cbf1f9e7d377b28c8f7f1393e653c03b7e6393dc6e376b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "ba41fc07-b90f-4726-bd19-121dc8e12841", "comment": "Malware payload", "value": "848b3ff0d3d7db733f7f21a36a2012024ccd53fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "0940b4fc-0fe5-4908-8da0-5747f441f8f4", "comment": "Malware payload", "value": "b9059fadbd28fd2e7b31fe40bde16eccc2c1cc25aea25ab161d17c470c27c984da765658ff514c5e2c4074af912a5aa5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326702, "uuid": "8b5c4b80-d91a-45b1-b189-7c7df0058165", "value": "T1BFC27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326702, "uuid": "38b1bac4-bb4d-4b48-80c3-9b31d678cc5a", "value": "768:Cs8vCB+25j6es8R49FYpMSUpi+20qUpi+20YQX:98l25JOd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786326702, "uuid": "6c051b74-97de-4982-8525-ef3ea8e19417", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786326702, "uuid": "18e94f0a-07a1-448b-b03a-646c12b94ffa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326702, "uuid": "6c9816b8-9bc6-46dc-bb29-a9209904b77f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9782cc2b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "d1f450cc-e5d4-42f9-8c32-a5499f8fc2b4", "comment": "Malware payload (AgentTesla)", "value": "b70d364d8d7fdb503b7f01f780566dca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "4e6f19dc-3c3e-4da9-90a0-982834324162", "comment": "Malware payload (AgentTesla)", "value": "52c40732892a9a76fb5d0541c9364e27ba184e516851d2395ed7fe23a867ec01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "9b95f9a9-7573-4769-a3b0-3a382b7d25c9", "comment": "Malware payload (AgentTesla)", "value": "48daeed7e8d1a6695effa910bba7d0d821a8f3f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "252098fc-9009-4007-8341-92f7b75c1bb1", "comment": "Malware payload (AgentTesla)", "value": "2a94d016e0cf085e45a4b1e2291ef0f432bf0a967d2d90566e45dddd56a9f763badabf85c1d6fa3e6ad39c6cfb1774e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "cb97a0e0-0c5d-4a33-9897-fc3dc0e570a6", "value": "T1322522186658E623C94117B52EB4F2742BBD2DE96800E52B5FEC7CEFBA33B148C541D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "b12e9ae1-6e15-4def-ba2c-98e8fddb4f2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "6ce387ed-65ba-4cde-8e8d-b43e3ada0926", "value": "24576:hV06pPSuqyjXF7AWi/KVsMyMC2Knu9QW5Ew0jyJGi0:JlSkjXFniiyMyMbWu2oEXun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371609, "uuid": "eafcebdd-5321-457b-b94e-f71fba6bb613", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371609, "uuid": "83fc8d35-134d-4e8b-bd92-725ff0e1dfa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "1f42b177-6187-468b-a9ac-d3fe586fb762", "value": "52c40732892a9a76fb5d0541c9364e27ba184e516851d2395ed7fe23a867ec01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b533111-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "da467cdc-02db-4b38-945c-5233d0761f3c", "comment": "Malware payload (njrat)", "value": "027d100f1dca3a4d9de8c40bbd60f4f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "18a6a6d3-1d5c-4b9d-96d0-1aceb0c91331", "comment": "Malware payload (njrat)", "value": "52c91de28d6269f6f1b20f7dc6054bf44ccf2e4da1355d71026e2c5b6d6cd0c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "079848f0-0ece-46aa-993d-e1febe629454", "comment": "Malware payload (njrat)", "value": "60e38277bf32e0fb5b47e7ec9e47cec9d57186ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "9cae2969-4456-410f-b359-cb1021c31b63", "comment": "Malware payload (njrat)", "value": "216666b9d19d6bf056b44d351a342fcfbfaf9ae5d3d8e7d1776c05e973b60fc14c8ab80529e8782fde07891152e65430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "014296d3-5a8f-4636-9a84-76a5624aee4a", "value": "T1C7150288321ADC02D5E26FB11E71E3B855B98D88A825E303DEFEBDD7B47D6463C44291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "c71c2912-289f-4de5-86f0-ce11b12433ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "9358c00d-3cda-4a6a-a71b-f7909a6072c2", "value": "24576:ZyIaRNQgDql+smIP6wXGvNZpFrP1lkR6pF:ZraQiqYsnP6wXeptEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370944, "uuid": "2d7e6460-e294-4426-98ab-bd1b9c0cfbfa", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370944, "uuid": "94565b8c-299a-4891-8aea-603d012ec9a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "5169fc54-daba-4f23-a172-da923cb2193b", "value": "52c91de28d6269f6f1b20f7dc6054bf44ccf2e4da1355d71026e2c5b6d6cd0c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287e177e-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "f2db1de4-8fcd-4789-8c94-5fd8457592df", "comment": "Malware payload (Vidar)", "value": "53df12e00344400d122deb2f6bb0f568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "0f5fc09c-f640-4b1e-81d0-0807e2b9f4f2", "comment": "Malware payload (Vidar)", "value": "52fbd46392992db6e89f8c621c3d6481f1ef5ae27f5017504b5501945cd7d7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "5858c123-83fa-4933-bf1c-b67e44127b2d", "comment": "Malware payload (Vidar)", "value": "8b7b3b01eb1f80c14e3aacc84703784021201c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "67c20def-3b16-4882-92a4-c1896748d863", "comment": "Malware payload (Vidar)", "value": "d5c01920851f432c9d491647e13ca7a65d73c301e111a71ffc36db9da59cb31ace4f38e332adf45b410f7f1741731fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "2394beac-712a-4a1f-8550-811fb45fdc68", "value": "T19D923F46D11B9AE4C4E5C337632A166765F8BC602131AA3B9BEC7A7A0D11370FB503ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "4c9d488c-7c2e-4105-9cd4-5a47e56a7eec", "value": "383dd58795248eb99a4152fc6e9be0d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "9fa55e39-ad49-45ec-af75-50049967f452", "value": "384:J/eQj/ex7Vv3QXcIz4RQH2NOIumNPU5Z6AadLMvsDPpxlw:JWQ/eP3ih4Rs3IoLLtqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369275, "uuid": "18a54dcc-2cd2-4d22-930b-29312b65d7f8", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369275, "uuid": "051d748f-1fc8-45de-a0df-98ea2f373c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "1635fc96-753e-4163-ba31-20cfe2edc067", "value": "52fbd46392992db6e89f8c621c3d6481f1ef5ae27f5017504b5501945cd7d7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba4dc3c-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786373548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "d774d829-f96e-444b-8a85-fcbf30b534f4", "comment": "Malware payload (Efimer)", "value": "3dea6ebc3212e9410adcdae1c20abba0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "7bc61ce5-0e85-43a5-91db-012cfad81fa2", "comment": "Malware payload (Efimer)", "value": "530c05cb0ef409701e6d49e5bac0b1861ce6ea33fa3b86c199672e8624379cb7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "6cd2c663-5bb3-459b-a72a-29c7efdc5825", "comment": "Malware payload (Efimer)", "value": "abe0f3d8622dfe068fbaeee5e1e000d70dd92bba", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "716c4921-0cbb-489f-9f30-020bd8220258", "comment": "Malware payload (Efimer)", "value": "45706bd0a9edcf7bd4c54adad13985f4bf74f7e192aa82cc82f7dd59541befa212fe5a48b47597bb6bb5623361bba3f9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "e70bb6ac-2e41-46c7-818b-567ed9980534", "value": "T15BE6338D5AC413BDD9639434EAD201A5FC75B8745372CCDB0BB886513F2B2808ABB767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "8aae42df-9a48-49ee-b67a-1111d1bc3a6a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "4b813a23-c655-400e-a04b-678ad94363b3", "value": "393216:8WaWTDf3y7hP6AzL4mvXMCHWUjecuI3/PGTAI:8gfi796AzLfvXMb8TH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373548, "uuid": "c2b699ac-a0be-428a-a868-42a5bc84f9b3", "value": 14074595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373548, "uuid": "0e84b96c-194a-4b9b-a58d-adef88aa51b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "ced5655c-0a21-44eb-bfd9-05ea6945da5d", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d98c95e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "23d3de1c-40a5-4cef-abe4-b7eab40ce49a", "comment": "Malware payload (Mirai)", "value": "993aea486757f50d2a960f70a2f3c44c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "2bd20f05-18ea-4e76-9077-20f835f6d3bb", "comment": "Malware payload (Mirai)", "value": "534351fca9e5792e7c114965bf76e4edd0087f591f6a8c251ad3486cfabd0354", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "f252c31d-177e-4beb-ab1d-4eb7e45d6176", "comment": "Malware payload (Mirai)", "value": "d78402d8ee8e8280e7774921b1280f84a067eff7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "1e38e33b-585c-4096-96da-34d88151bd33", "comment": "Malware payload (Mirai)", "value": "30ef1372c7a9539af1a0a978e5e6db18b6417705652c94b8431501fdebaf974ce635fa7888b441ec8df83495a56b9250", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "950cd873-a923-49d4-8415-469bcbc7625e", "value": "T17FF31955F880DE62C5D12A7AFA9E429C332307B8D3DA7102DD205F3977EB95A0B3B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "b9ffd015-9e5d-4c1e-8087-07c7bfb64787", "value": "3072:uxpOYOMD0EzfhJRhpIRYheEkmXy48cslyYBYG1sKoi:uxpRXJRhpIhEkmXy48cfLGiKoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383591, "uuid": "cb6c7245-c1b5-49a4-bf31-10c1ce4bfc1f", "value": 169628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383591, "uuid": "6bdce9c6-b589-4f9b-b322-b0b01fc6f8ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "a54e6fc6-af2e-4ea5-bc75-ac5db23c3513", "value": "disconnectraw.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4b9710-94cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786374405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "780b91dd-f9e7-43dc-8fa4-9a181a2eaec1", "comment": "Malware payload", "value": "092273b7140ec66aa391ded63742dc79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "ba300174-1f79-4f44-9a0a-bc82728ebdef", "comment": "Malware payload", "value": "535eb88d35afcd8050dd928944ea5a7edaea2662d1333b76e49aaac42882c9d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "8415fb94-7bec-4f84-bdfb-1f51d8cb107f", "comment": "Malware payload", "value": "b3c719a3117c30b58d5e43ae495d2858d3db5b61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "4bde2cc2-18c0-4fbc-a396-a5198bdbb513", "comment": "Malware payload", "value": "5cc8ffb459d35b4abcfaae73a402adf5a58e2df854962cf8e915c6570acf9a86f4655183dfe6d9f6c66a3db87f657389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "27cc141d-1d30-44c9-928c-4f659e00e19a", "value": "T11E77AEA3B252C473F5C250BA54ADE63B1728BD300B1516D7B3DC3A1A95706E27E3BA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "a6d4a133-5f54-4ab4-aaca-e7c3cf8f72cc", "value": "d4aaa1b000dde1b92b1d40795a403529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "309af184-0f09-42d6-8a23-4d507ba6bd4c", "value": "393216:C90YhxQX+0YCghOJf5rIPKk8XgSueAjR2sASt39W/yJsv6tWKFdu9C:/9X+01f5a/M34R2Wt3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374405, "uuid": "b1e9adef-317f-4b4e-bb6b-27706f369d95", "value": 34471936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374405, "uuid": "c93abcc3-8e73-40fd-b5eb-22c216439ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "5749a0be-281a-41ae-8a5f-80db150c5af1", "value": "ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5715b92-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786327904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "cc43703a-dc63-4572-ba9a-7184fd614931", "comment": "Malware payload", "value": "a440af32d4f66eb14aba1cbf90eaeb83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "739d59ec-78b8-423b-b2c7-3230c98afacc", "comment": "Malware payload", "value": "5417acf48dbfb04701be9fa60902059982e5f9febaebfeab1c9f51166b6fd144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "a29dac09-9d5f-4e84-8b51-6ebb8d730463", "comment": "Malware payload", "value": "df230e3521762d165f89b489173d506adc5d49b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "8acf86b5-4054-469a-8bde-6c9b9e6d1f4d", "comment": "Malware payload", "value": "7bebbd029009478e272cd7f74a88043d52f8b97cf1855fc337eb6c3286dc99dcbd06eae5393717297b5666ae971697f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327904, "uuid": "4016dd5c-9177-42cf-9d3e-62d495daf749", "value": "T1FE63452A1A21FFFEE16E823047F39E7097556AD636E1C280E26CD7085F7028D185F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327904, "uuid": "7d714d93-d007-48d8-b87e-23e73297dec9", "value": "1536:Jib+5AnryiihUgSgYpYvtc48d2hzTvawmJy77V2twXE:nKbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327904, "uuid": "0aafed6b-5fdf-415d-8eef-a0e011235c31", "value": 68432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327904, "uuid": "0fb6ef4f-eb1a-47f4-a920-245ca7a2ff9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327904, "uuid": "175ae35b-7666-421d-8912-a4eacaeeb9fb", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f7cc54-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "19eb016f-c95d-4d30-8b9c-a25e043c39e2", "comment": "Malware payload (Mirai)", "value": "9422d0b1d0cb55f2437571ad40233906", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "272bf461-7183-401a-a19e-e24dade626ec", "comment": "Malware payload (Mirai)", "value": "542af17c9ac5569bb8222ab211a9ada2d6a4ea7dc69c8c503a970c713e4fe11b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "91656ca3-e803-4e3a-88cb-4108165206cf", "comment": "Malware payload (Mirai)", "value": "a8e3befec4a93b29fe4eda6b6209e3e3c6f2093d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "e683ba59-f4e8-46bd-bd25-5ff3dedb7d4a", "comment": "Malware payload (Mirai)", "value": "bea6be8222e90d14776d8d3a48e63f54a5a2f5d11a67d1561e7c50e6d8548408d7da4833b8bac1de4b8522dcf96046d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "419499a0-7f6d-4ccb-8937-e371800821fa", "value": "T12E049F73E8256FA8C2958174B0F48EB51B23969041876EFA66B2C3764047D8BFB1C7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "9d79b25e-b91d-4637-9a18-7265d859b8b4", "value": "3072:mLznDMhnMN18lUXlwnsZIpoW5DL8Tpgo6s:mHRN18lUXl6zx5DYTio6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356948, "uuid": "2648b90f-d9a5-48e4-a93d-4755e454826f", "value": 180248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356948, "uuid": "5fbd0691-9df6-422b-9258-ee860111d63e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "8b5bbfa2-1ffe-4402-b81b-68da50120322", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2190f6-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "0be26ea7-4fac-4843-92eb-58447a945f4b", "comment": "Malware payload (AgentTesla)", "value": "81b1e0ad63253354ec88840c718dd164", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "e8ba634e-38d9-4c6c-9165-96ae27d51383", "comment": "Malware payload (AgentTesla)", "value": "54c1cbb6ad3d27f0987613748ad4d4778288bc812445b51e7af0771db17a4a20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "36977121-a2f2-4d48-ad42-737c08b05e9d", "comment": "Malware payload (AgentTesla)", "value": "ea5b6d302a2ca3a3c0eddc4a285bd4edee3f8e5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "3e5b9d96-30e7-43a8-831c-8073f680d1b3", "comment": "Malware payload (AgentTesla)", "value": "455a9a9b2eaa26bccd43e76ba7ad0ddc18f85c3101d748b4f7e76ae9e73edf6176b722044e684a79a4ee89e340ff1a63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "a399d228-4fc3-42d9-b173-02b7930ffd1a", "value": "T1EE35F154171BD802D1D18BB7B8F0D37433A48ECB79D7C3865EEA6FA7391A7C25984282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "29aaeb8a-509f-487f-bb4f-cd8dcfbbd571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "2268a94c-5c30-4cf4-b463-de2a6ef7b8b8", "value": "24576:sp50WE3WdYC0ViyoRIh9PexlFX4PoeoyHxrF//7A:spPdgViyuIh9PexlN4PJot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372796, "uuid": "a337040b-db2a-4c9a-9c9d-95c10283d857", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372796, "uuid": "6355e7b0-b16d-4b23-af8c-0b27acd91084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "91307820-ce83-4754-9f43-540d72dd020d", "value": "54c1cbb6ad3d27f0987613748ad4d4778288bc812445b51e7af0771db17a4a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d597e6-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "d8aa7ffd-e47b-483a-aec4-d158b5841b0e", "comment": "Malware payload", "value": "e6f97b56011c419e8339e1b9b7b9c92b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "3e81aace-c592-480c-a3a5-730f8e0db7a2", "comment": "Malware payload", "value": "54d1d87a08600f28fcf8b9b64cee918e8cd65222c558b424503657f1cf0395c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "c62e0a3a-faa7-4ae8-9ffa-a96ca8d6a6e1", "comment": "Malware payload", "value": "b4d823f3bb9dcd81df4876d77e140e41682cea0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "c2acc801-2d43-411f-81b5-2b3fc6eacb1a", "comment": "Malware payload", "value": "a3ce5dc8c883dba4f679c652877e43d87064609dd116d0b90a3756e66f9063d523cc898a18c850af3aa64d3dde5f424a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "a4145376-ff02-4282-8235-85fa13a815d4", "value": "T129072233B66A613EE0EE4A355A72A232553B7E607C139D0A9AF4145CCF351A03E3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "fb6d0c93-53a1-4524-9ac4-877b8cd26e16", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "c9b80f11-79ff-43eb-a96f-6d22e8af20d3", "value": "98304:8AX7j334yOakxot8YZaG86HKCy/6uR4F0QWMgieJS8BNKVX6hlEd8AYEEFjE/HLY:7j37f86HKCc2F0QgJS8Bk7d8GEePk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395039, "uuid": "523d4a77-3d6f-42f2-a417-2d7fc2675ac7", "value": 16852380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395039, "uuid": "d658d773-da26-468a-93f8-3b2f422983ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "e0a67dc1-6da2-442b-b8a5-069f0f8cc8aa", "value": "app_launcher_setup_V8.10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65e1e8d-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786373862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "d8e8156c-3c62-44ec-82d2-a42e95872961", "comment": "Malware payload (CoinMiner)", "value": "b5a82328f57ded256ffc44f58da1541d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "aa72e478-a2eb-4454-a30e-cfc7723384bf", "comment": "Malware payload (CoinMiner)", "value": "54fa7e1901aebe02bf8935769ed66f6bbb750f2adfc1a2283eec2372bcef32be", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "14b09b51-1842-4a1d-b99b-5a2afd04c203", "comment": "Malware payload (CoinMiner)", "value": "bde49cf6e43fae18717a5da3bdbccf9c9cc666f3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "e762f3c1-b251-49d1-867a-128072a12eb1", "comment": "Malware payload (CoinMiner)", "value": "ed53de6754c826eba38e0b6c8aaa9f346db1eb0bd986f53dd1eaedca8490901675ded5a19c621a014477e76fdeb5e39c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "0a5eb410-52d0-40e2-a8d7-fcc9b1e0a816", "value": "T164D5238AD3AB64DCE4BA04B44D2105EEABB27B51CB17869F2397F53A1F126D0BC14F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "f46cba0a-0efd-441c-b865-e004069cc882", "value": "36dab651ebd71b404011f23a733060ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "603160a9-5cc9-49cd-94ee-7c082e210418", "value": "49152:kLXnKO43hkANtwJMZnyH3OfoF2CgcVJIGUXy83fyQ1krTY/H/u16Fgq1PFI:kbnJ43hrN+iZyH3O1CxVSGUC83fZ1kr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373862, "uuid": "a01da2f6-67e1-4767-9b55-5909d756c6d1", "value": 2754912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373862, "uuid": "19c0e991-9f85-43ee-8fb2-2e71b025b66f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "07c9c344-3b8d-47e5-b29e-fb005a46b26f", "value": "54fa7e1901aebe02bf8935769ed66f6bbb750f2adfc1a2283eec2372bcef32be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73c02c1-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "61acdb2f-89e8-4e2a-a552-b598e509456f", "comment": "Malware payload (Vidar)", "value": "111ae95b04f7ae6d6edde1b17cb21743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "78bff842-3621-44e2-b92b-28122c337efe", "comment": "Malware payload (Vidar)", "value": "55cdf65aebe83a959784b637a9aa2828f7f532392bb5bb2f5ee0a3ee8844c325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "36ee89b7-8a06-49c4-b599-ee10fe13cc87", "comment": "Malware payload (Vidar)", "value": "779dd9f734ee27721641cc1e3753f75bf456fc10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "7bea59dc-d326-436e-a2eb-e50ed55edb24", "comment": "Malware payload (Vidar)", "value": "b9f1c11dc7a78c5e830703c793ae2d610865b8e240f18d07ff116a236b71a22a83415e6ecb201154f27ad10ca768db89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "99011079-6fbe-41d3-9d06-1494e4a90f20", "value": "T11092B345E047AAE0C4E1C337A71A569719FCB82032359B3F5BED667A0D92370E7502EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "3a3f569c-0631-42a0-973f-384645bc21c0", "value": "11947076675cd2ccb7ede65c6ece700d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "daff632e-d231-4974-ba71-9b962b54ec95", "value": "384:O/sSk14cjVzRhFUEt+5aTmgyW8D0Tn3aqjaGbY9lYG:k2bE8TTmgGD0T3W7HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368253, "uuid": "d11c43f7-b937-42a8-b381-ddb3ba21748f", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368253, "uuid": "2ea3db0c-434e-4498-85db-7b881d5022ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "3a232a28-8db6-41fc-82b6-df7bf159c8f4", "value": "55cdf65aebe83a959784b637a9aa2828f7f532392bb5bb2f5ee0a3ee8844c325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bf3a33-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "7bf6e708-afe9-4341-a7bd-00f9b753944f", "comment": "Malware payload (Vidar)", "value": "bcbb74173b6d1ed18e0a5c5ef32beec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "68778ea2-b4f1-49aa-a9f4-b21c6d99adf8", "comment": "Malware payload (Vidar)", "value": "55e846717b5cca16f3b8fd0fdae97bafe5bc09871179a6778addb3a7f20ad79c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "272e47da-3192-45a7-b1f5-58f6293124c9", "comment": "Malware payload (Vidar)", "value": "df87a73d6f2e7659564d3935d8b7c8ee5a422b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "b425fb3b-4356-4ad0-bf2f-d5d0b12430b3", "comment": "Malware payload (Vidar)", "value": "253cd1b886e4c30801d2ba373f6dd21fca08fc1cb7229da26133b305517cb6812965d3469c94c4a068e32a5c8fd6d1a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "019e29e7-e487-410d-baa8-d1f8e783ff27", "value": "T17E82A746E117D6E9C4D2C336631E026766FC7C1426359A7B9BDCA72A0E83370EB542EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "35a715b6-6df2-4d97-b9ab-765073c861fa", "value": "147d9559d7e86cc7d3c43b072d063583", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "06c53d61-c74a-4c7a-b2c2-91553aa687b4", "value": "384:OYiaGk6TY5qp+uy6rwPSdlT7V0+FeFmhRb5l:IJki44+IwKdlVFemt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368787, "uuid": "076c3533-86cb-4845-8b63-00c69498a874", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368787, "uuid": "38141d17-d757-45df-bb43-3a8c9377d407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "7d259c8c-a5c6-494d-b2a7-9078f684b6f8", "value": "55e846717b5cca16f3b8fd0fdae97bafe5bc09871179a6778addb3a7f20ad79c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6012adf7-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "d30f3346-0b09-4489-888e-e61352f49876", "comment": "Malware payload", "value": "bbd715166cc5c490261abfca20ae1673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "cb06ee72-1a8b-4aab-98c5-2e7d3278294c", "comment": "Malware payload", "value": "56061e52e23cda852af251197747b8e1f70cdf84502ee0d4b16ece2e9e84aa2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "2d39be38-8b4d-4656-bda6-5afa549561d7", "comment": "Malware payload", "value": "8f5a6771c876abb1a1f9f302b2c2c9aad8ee8233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "77ad1de8-918b-4ee9-96c2-774fe0c86a92", "comment": "Malware payload", "value": "96ff6e7928b2f2b497cca5a434a87b79ac852135cb4beec8ef4bb1e1f92cf3f068e5a52015c32dff595f071f1837d6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "897aa953-2254-4722-9f17-c0b267a69f4b", "value": "T14A25F1161D8B6B55DA3D8F78C265498433F0D9035312EB5F2FFD10E6AEA2BC98D22067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "8587227c-899d-417a-a4ee-6736a1f6e1bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "838c77b5-54f7-43af-9e89-b48798ba3ce4", "value": "12288:Hd8H7nebB5kODVKaZuCgHebdfSdkCmVALeuFWrcaWolkQvddbY3kAu:87nefksxDZsqVALNUSQkQOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368939, "uuid": "dd367339-958c-483a-95c6-ed1d4c348263", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368939, "uuid": "1622a939-7ac0-4324-bd14-630b5ac95bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "e8b0f6b3-6fc0-4d5f-9823-496b91c1fc01", "value": "56061e52e23cda852af251197747b8e1f70cdf84502ee0d4b16ece2e9e84aa2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d810c9-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786371545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "6bc6ecc6-a78f-4e14-97f3-2dbcf0def23c", "comment": "Malware payload (njrat)", "value": "0a4f21acbeddc2cdd799119504686b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "d8f7ead6-b29b-4310-a346-07016edf95c5", "comment": "Malware payload (njrat)", "value": "5606772da0f42f2e5d4c69b6640b57aa187e0bfe10e61a15edba291135559253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "f5b08495-026c-4486-a44d-7dac6a00139c", "comment": "Malware payload (njrat)", "value": "fbd0e56a588a4a57c8b45c7b6a6a3d39da1d43f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "d8f79d8f-d190-4f45-bb89-dd2fcb5f7b29", "comment": "Malware payload (njrat)", "value": "cf5b7cd03b4f9fb2882e3fc419364ad24c3d215afc204d73267cf98503a67f89988966366436b1b96021d51b6e069a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "644c3cee-3581-4826-987e-f7e88cf40233", "value": "T12D15E1794AABF602C54116347D63F3B10B7D1EA8A4CAB1128FE77FEF7A72C5425110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "208900c2-5c6e-4e0e-aefb-9898061b3138", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "c45178d0-6256-437a-842b-bd48d5f545c6", "value": "12288:1P/y1lJdbbyEZq00TituI3YI2x9+0d+FQAKPWa6hdgFymFw70IWAJ:1P/6p5aith1bgAahZFym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371545, "uuid": "155a8d53-caea-4b2a-a9ab-1d4a252148d2", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371545, "uuid": "74633278-fa06-4a98-895b-ae9afd590025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "c029b910-b1b8-4f86-982f-cd39bce2f459", "value": "5606772da0f42f2e5d4c69b6640b57aa187e0bfe10e61a15edba291135559253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8710fdc8-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "92166aa7-cb69-44c4-89e2-c1c0e0a3c7cd", "comment": "Malware payload", "value": "a65eabb63a2885cbb783f7fc1ab1604b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "5ba59d04-84ab-468c-9ba4-306358b0824c", "comment": "Malware payload", "value": "563b54c72ce7e4bc83716b76b57ee3dbf21ae48d525dffcde2ae8090031465a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "8e89d915-a87b-4207-94c4-2dd4a32f243a", "comment": "Malware payload", "value": "cb8ff12d27c42b8843a853880fb07e8b8a016efc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "f8d21d5f-7c16-4122-ae1d-8b82c8ed0c1c", "comment": "Malware payload", "value": "770d0310b5070ca3d464bbe10722db25ebba157191d6ff676bf76f91962615419784f670f32644ae4a8b84a490905f5a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349677, "uuid": "7a8633d0-f6c8-4fd9-8618-d905ecaa7cdb", "value": "T11E236D651A857C24AA98C4371D7E2F0CBDAD43E6324492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349677, "uuid": "56bb509b-c39c-4b3e-8fbd-85d0b1cc54d6", "value": "768:sXRWNGxV/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:AlxKcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349677, "uuid": "c9f31f58-e352-4d89-83d9-148bd61a9b9f", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349677, "uuid": "87f14cec-5dfe-494c-9cd0-4f984faf44ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349677, "uuid": "ba7212a5-6bb9-4527-a354-fe47de0ea65f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef306b7d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "00b1dce8-4f57-4523-9fa2-0e5713f4eddb", "comment": "Malware payload (Formbook)", "value": "07b41dafc43bb6513dc40850e9b1762c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "15b924a3-0de1-4e7f-a9ac-359277f49d53", "comment": "Malware payload (Formbook)", "value": "566496a5d069886d1125076b4b9d0f728c306cc6989842daddadbe53db691e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "04e47118-cd40-4a5d-8e27-50f0ca34ac3f", "comment": "Malware payload (Formbook)", "value": "2a398584f5542833d6119bf0a0c3c6df5ceb4603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "554c824c-d384-426f-a3d9-4f7b2e8b0ae3", "comment": "Malware payload (Formbook)", "value": "756d972c4fb38cc7f850e750afbd27a1a6e39330af7e3d3bf415f4905f69b6ae75a013fcc895f2e5a22f026358370c28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373474, "uuid": "a775c34a-4e89-4f40-9cc0-9b49eaed5bb1", "value": "T120542321EF1FA1CFE41B29B084EE9D8B2C40AE35015EDD679BC42D5D32AB1C473592A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373474, "uuid": "7fd5c3a2-dfd0-413d-9b47-d6bb73cb7b3f", "value": "6144:JmVDg55l77psgZ5I/NQiXwiY/mbEmSIxFHK:KGqLw3mbbSoFHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373474, "uuid": "7641909c-a8b8-403f-afdb-c92347c6a524", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373474, "uuid": "a633019d-a61a-4b6e-807c-a3ab02ef6b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373474, "uuid": "bde7930e-59c8-4a8b-9630-8266b5209a57", "value": "566496a5d069886d1125076b4b9d0f728c306cc6989842daddadbe53db691e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aca2984-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "d6dd3678-b605-474b-9142-70e5d24d010a", "comment": "Malware payload", "value": "727bafb1b47d4696d628c2ea4ca3fb0e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "b3b1b044-4238-437d-af7b-17aafe7bdc59", "comment": "Malware payload", "value": "568d546ffe4d204289950f208306c8998a9fe58f98d5d33a81d2706471a1e6bc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "9846902f-df1c-4e6f-b7cf-23480e976847", "comment": "Malware payload", "value": "2d709a82c45f74d5630553a9747ca92455c54674", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "75698af8-3deb-4fe7-b870-b6a5af087b24", "comment": "Malware payload", "value": "d83fc5c082d6ef23f6dd9d711e3e3668755cefabee4d1496fb559058e931e63d3542fa98fbcef02d3a1bbdc50d3521be", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "6dea2565-cce1-423a-93a3-d2754041f885", "value": "T1B1E6330C76D025EED9A3A53DECE111D2DA26B47207B6C8DB979843E2AD135E44C3E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "dad7d4ca-ef1e-461e-be52-4084d6ea7666", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "644daee1-f92c-4708-8f15-043a821cf403", "value": "393216:HpZ3SUUO1TshtK9g8xXMCHWUjPcuI3/PGTAI:HpZCUmhtK9g8xXMb8EH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395156, "uuid": "c0c51759-95d4-40d1-81db-baf6600e0bfa", "value": 14028495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395156, "uuid": "6bdc62b9-de3e-40a6-b58f-b4998de542ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "6e4b0ea1-f8ad-4b53-a293-f0bee2e99b46", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6af71a2-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786339932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "e5bc0ea9-1596-48dc-8d4e-d8f3e89edcc0", "comment": "Malware payload", "value": "78e9eea9bfd9dcb0a7b854283f5b3558", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "ac184516-aab5-443f-89e2-b5589ad4b8a6", "comment": "Malware payload", "value": "56a5705a780f848faa55e8571d97f70b1462c2c2f3ccf0c6aa25ea8ec3f46cd6", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "8e489b68-d1d7-404c-89db-3bd36bc19355", "comment": "Malware payload", "value": "59d9388c1f087a45b1a30ebb1b896192b9dd97ee", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "246230d5-8686-4d87-a727-7ff2f237ee5d", "comment": "Malware payload", "value": "b776e06d5beaa9a112ad60218589f85e9f9411282f3ec9e22f911a3e95a72f8dfc4086f5705c28fd47529449f91d2e5d", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339932, "uuid": "aab7484e-5e36-446e-a38b-dffe3988251c", "value": "T152F024DCB1BCCFE10DADC88AF1F094004491A48BA1F46BD2F38D0A30AF54E8A396321D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339932, "uuid": "ea699f36-0f77-4a69-b426-dea228016075", "value": "6:vtmc4Fh5XAYVic4subid/n7owc4Fh5Xo4Fh5XjhHArGHbiOLxGzWiFMxFraF2vcj:FzY8id/7PAC7ikxGWi2jX7k+XAwALnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339932, "uuid": "b345978c-c35a-4422-9e2f-67ed2e6979ca", "value": 627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339932, "uuid": "1c0c5225-1843-4c64-a49e-3f423a4680db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339932, "uuid": "03f2f3b6-b3c4-4d82-a45e-a2a82c3fe873", "value": "payload.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ed8a34-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786373938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "39ed7e1f-d126-42bb-8c08-aa154cbcf979", "comment": "Malware payload (DarkTortilla)", "value": "8bb96022e87f0b2934b237195cc00b2d", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "6d32639d-70a2-49be-829b-76241f1b4695", "comment": "Malware payload (DarkTortilla)", "value": "56c4a323f13dcfba07b6ec718b6f0f29d4d82a8df3dcbfdab3410b77b3b3afeb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "3e003ed9-d593-483a-87e7-5e6c93d90255", "comment": "Malware payload (DarkTortilla)", "value": "db06c2d01626544f66cc971e5a01c1b504b7ff50", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "4dba6c21-e418-4300-b01f-5b7e984f5d1d", "comment": "Malware payload (DarkTortilla)", "value": "b9c9e4a97a9ba9377268f36271d9159e4b38fa1eb3a3c6c7493a0f4bb008730139adfcf8bc2e32384633b744f8988a3a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "d690294d-eed3-401f-9d5e-d4d1d833e4b0", "value": "T1B235023E6FC32F65D5BD4639A175008813F0A60F1242FB5B2FD912EDAF53A4E8607686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "9f0cb5d9-759a-418a-8476-46c62b2080c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "153f2e1e-4ecd-4fd8-ab57-e50a9306ee24", "value": "12288:4zb1yS6nRZFoGlHV7+myiYkt8OK/DiJdPRpqTkKp/pzS7bTcQw+CtBsVM1B:4zZyxRZFHZyiYl/DiJlGX/UbYx5BsVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373938, "uuid": "b36d7574-c01f-4dc1-ab7c-d33ada57aecf", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373938, "uuid": "9277af37-adc8-4985-a03a-cbafa3d1c7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "3d4179ea-51f1-4f76-b697-42a4dc3cdc30", "value": "56c4a323f13dcfba07b6ec718b6f0f29d4d82a8df3dcbfdab3410b77b3b3afeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63907590-94e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786385265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "f8234278-0531-47af-98cd-3c5a83b11380", "comment": "Malware payload (ConnectWise)", "value": "5d7a3ab13de85fe631512de70fab6264", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "90be36d0-e6fc-4086-b350-a31d92cbc26b", "comment": "Malware payload (ConnectWise)", "value": "56cbbf481154a08fbfec54484ca04f6045dfe0e2fc082c6249592ecc4aaf1c5e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "be797dc0-4c51-4043-8402-07f53b87cf78", "comment": "Malware payload (ConnectWise)", "value": "f97ee17831571415fa84f251f32714225d111c3f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "0c2ccd11-22da-4aff-adae-1defcc893810", "comment": "Malware payload (ConnectWise)", "value": "6a4681bae12c92917d3c72a3738896407fcc1fa5481ac2cd475ba230ffb310ee2b97f79f447a8ed60163f982836f9d3c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "d41de69d-d31b-4e59-874b-919c18ae54cf", "value": "T125834A53B5E18476E9720E3118B1D9B4593FBE110E648EAB3398423E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "687f2ba3-3f86-4ce1-9fd4-aac6420788b3", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "078b7e02-ad16-410a-a44b-bd2bdb1ed5aa", "value": "1536:6boFsMHqzISrGqx0WiwbqKHxfd6dldV0OCJRpsWr6cdYV7hsYYYK7Af:n9q8tC0C+axfdalBqRfbYRGYYYK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385265, "uuid": "5efbbfa8-d368-4376-aa7a-452179a9b7d6", "value": 84216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385265, "uuid": "80e4597b-4559-42a7-bad8-3b3e165ba255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "6607335e-60f8-47c8-b55b-e7a9caddb1d6", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621bc3e1-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "73a4dade-77fd-4d95-9d0e-d30228b85e2e", "comment": "Malware payload (Formbook)", "value": "06dab69f3e53e03aeba5d95b52bdf541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "625e3f4e-491e-4769-83f4-7d54fe290a36", "comment": "Malware payload (Formbook)", "value": "56e0ffb33535d3f0aa4ebd7bfaa2ed3269f1d0475c762e01ecdfcbdcf471f076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "5fe9e476-bf04-4acc-8237-15a13754ac6d", "comment": "Malware payload (Formbook)", "value": "38aa56a54d34913f5ba85a7a4984055a7bdc4d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "27759c92-115b-4886-9ece-2a8396369f00", "comment": "Malware payload (Formbook)", "value": "1a40ebc6f540a0f4b9042c58918c2bf0f5abbe1b78bf62f9643e9f9129e5e6867fd570b7817339bacebe26c978d69cef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "76c87b56-0d78-4f76-9346-924cd2c79224", "value": "T13B3512446A8AC904D5D70B34D4B4E3F843F27E9DE821C64B4FDCBEEB38667126848766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "317777b9-1a36-4bab-8a67-95ce5e414ca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "d3d53f61-7676-49fa-bb07-b9b7d9a68169", "value": "24576:auri3r5ix8/4DUjk1D/+9MxCSY4cY4BSkYEhTxfm:pO3r5vA4jk9/+9MEocbBNLTxfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370660, "uuid": "0fef4f19-0aa7-4508-bf11-c97499362b83", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370660, "uuid": "6a0f4fe9-230c-45b4-902c-7cabd3075e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "08f52cbf-659b-480c-bd05-9949c645ef05", "value": "56e0ffb33535d3f0aa4ebd7bfaa2ed3269f1d0475c762e01ecdfcbdcf471f076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b744500-94e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786386433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "f174e8ac-c8a4-4839-82b5-e94c8028b275", "comment": "Malware payload (Prometei)", "value": "6111b9ba36527bbb8205bdda504016fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "7b035f6b-49a5-4134-b595-f3fa7760171a", "comment": "Malware payload (Prometei)", "value": "572f2c1112a4d28df48372e34c092126f50379147478a3bce39477c2cb8b6181", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "efa354be-2cad-43df-b31f-d6ba99169340", "comment": "Malware payload (Prometei)", "value": "59b1f14f3059e1faa08458060344c66aa2a81ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "44af4d87-839a-4415-b609-7311f602ef31", "comment": "Malware payload (Prometei)", "value": "61f477855fa1cdf744958c7999be6318f6f597d2fa90a1a9c7de348ef124a4eef84727f2ab539f6e0f0f31c4c6f5fee2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786386433, "uuid": "d8251301-7403-42b9-90fa-81b40a0480f7", "value": "T18D37CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786386433, "uuid": "1fcfbb9c-a953-4764-9b13-9580b4cbe0fd", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786386433, "uuid": "de56ace6-6043-4472-b2a1-2a40fbb7e568", "value": 23265280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786386433, "uuid": "0241d553-62c0-4342-94ce-b8adf13bf946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786386433, "uuid": "9b3139f0-16c1-4548-9be0-19c10f06d1c9", "value": "572f2c1112a4d28df48372e34c092126f50379147478a3bce39477c2cb8b6181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14600435-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786373107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "1a46a6c9-8bdb-4703-82f3-2d20979c5742", "comment": "Malware payload (MassLogger)", "value": "698dbd0f7705ed93ed8299d1fb4f4e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "d0bd202d-6861-4f85-a9e8-59c4a4b721e5", "comment": "Malware payload (MassLogger)", "value": "576a0f67a8fcc0a2e3adb30cb59903699761d9a0d11d95d6620d443f8c625d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "a91be767-dafe-42f5-9caf-3f6a38e8d488", "comment": "Malware payload (MassLogger)", "value": "cf825064935d1a766b7e05a7dd39f1098c4a5f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "e155efc8-2efd-445d-9076-117dfeaf4e21", "comment": "Malware payload (MassLogger)", "value": "9f97c52cf82244a6f313b828461fc00b489ffa911fb968447ec5e64b56644cd16c0e64a50752e2ffd59ad00b1f6d1495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "129aa78e-abe5-4d1b-b788-fb503f2ad566", "value": "T12D3501552356DD02E1E6C7F6B960D37432A80DCE39E2D3868FEA2FF7742A7C01954682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "927709de-407e-4314-8866-2d0f5c850e41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "25dc0fb5-1c8e-4f12-87e8-1f17e57241f9", "value": "24576:sJp50e5ddE+w2tnTZ/SRwgIxfykURCtXPqoCRgz:CpjLvnuIxqpRQ8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373107, "uuid": "48ce481a-96ea-4a24-a2ca-bca383073169", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373107, "uuid": "ec1cd7d8-0fff-4039-8ee0-84d868ff28a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "a3b807ec-a8cc-4ea2-b89d-a264d2c15d8d", "value": "576a0f67a8fcc0a2e3adb30cb59903699761d9a0d11d95d6620d443f8c625d4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b843ec42-94e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (SentinelRAT)", "timestamp": 1786384978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "e068367c-2079-4486-8d14-2544d0d0becd", "comment": "Malware payload (SentinelRAT)", "value": "ccdb449344ab0d621d22a5e3105600e9", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "9f2826a8-f956-42a3-a930-5c0b76e283ac", "comment": "Malware payload (SentinelRAT)", "value": "588bcfbb76b4903eb7fee85b36c0bdf82dc597fccde71496c33c9340d7c6c47f", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "19e12a3d-a88a-411e-899e-e0241af5d7a5", "comment": "Malware payload (SentinelRAT)", "value": "a9e4e47231100e051865b0eeb68dd5ce53103ab6", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "d3285f08-de45-48f4-bebd-cb9467222c7e", "comment": "Malware payload (SentinelRAT)", "value": "447a09c9d98c38cf33ffadf414c933848b1754ca0ce856275e68f75b8daf42f6032695272c8f09d057a174d21e99af6d", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "0e3b5407-9cee-4483-a448-701c1486f775", "value": "T1B3C3284033E85618F2FF9FB468B55196473BFA679A32D60E18C8209E1632BC4CD51FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "fd4d6364-72ad-4c82-bdb5-4afabe4f3638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "16ca36e0-f23c-4004-9ddc-0e1211f6302a", "value": "3072:qaeJ7KD6PrqHBUdJ+bBkcO4iTSByOtgcqcHcPcqbWKgYf:zUhrCBUdJ+bNO4hF8E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384978, "uuid": "9cbd1797-8c32-4caa-a72f-595e0817ef35", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384978, "uuid": "39c152a5-63f0-4625-8b0b-c463e333f702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "46ece5a1-a951-4464-9882-03d994b316b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3c16ab-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "c092fe37-dce3-4f01-9bf1-f45fb12dfd47", "comment": "Malware payload (Vidar)", "value": "c06d8c10bd95ec6b42b1df54d3f9b424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "d02b194b-61a9-45e4-8538-64262441a34c", "comment": "Malware payload (Vidar)", "value": "58b6dc6fba4f5544624ea73c545ff721afd820e035ac0fc8cb9ac0beefe89ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "3b1006d8-32f5-4759-af5d-5b94358e8cc9", "comment": "Malware payload (Vidar)", "value": "c80b36b2d01014244bdbee4fce840389000dad58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "2d23a37d-93f8-4168-8c4a-c6ffd708a811", "comment": "Malware payload (Vidar)", "value": "59142eefb6139ef059e31a733a821be4f70439a511db3c59494e56c7db9369ecd9e49b506e56cb1cd707d37e1213ef64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "cd76640c-79f9-4fda-b98d-ae62b62e9689", "value": "T17182A441D11BAAE8C4D6C332A75A46A715F9BC2022315A7F9FECA77A0C52370F3502ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "c3a59fd2-f57e-4e31-b1db-de2b2a9963c3", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "78ec3019-0cdf-4061-92dc-dab70ce7e8eb", "value": "384:BWBd++QpznCipNTHkv+4OwsmJwQqz7oLVhQCEKyKlwr:BNzvpB6ywpw40jWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372019, "uuid": "cbf0b85a-fd83-412b-9c3b-0cc52e43d4e5", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372019, "uuid": "795d023c-4b5a-4664-8351-37994dbeb439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "dfd08d27-f731-4fcf-a38e-4c5a03b20363", "value": "58b6dc6fba4f5544624ea73c545ff721afd820e035ac0fc8cb9ac0beefe89ee3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4c8a1d-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786327778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "888667b8-11cd-411a-94cd-78664c9ca8a8", "comment": "Malware payload", "value": "1d5ceaba43fa5bb9229fa8dbeb3597c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "5f6c0d17-8e0e-4409-a39c-03ec74ba7f86", "comment": "Malware payload", "value": "58f68179c5c95efbe4aa2d3943a7257ae58a580d71ca3a467d01372f9336e678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "43376940-e2c2-4895-b891-aaf012862cb6", "comment": "Malware payload", "value": "72fa4236753f7affd290f98ffba3d936edb41d3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "b50d4e93-488c-451a-af93-38a9fc9971b7", "comment": "Malware payload", "value": "eed04d3a97c12d76717e9c497e6dc2fffd097e3e7703cf618bfd176eb89ebd7477a7989cc759625afa44791861fe0fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327778, "uuid": "48122fa2-7be1-4692-b38f-88360330991d", "value": "T1FC53081BB6E3B0BCC297D0745A5A99F2B9317CA002213E7F97C8FA312E35D112759A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327778, "uuid": "d118c880-a4cc-4d49-85d1-d5e4e716d30d", "value": "1536:5cgDdE1lbUjiSNkvEo5untFqXby0Rr6h6z3Ur:5cHfUjiSCmq+3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327778, "uuid": "510c2d9c-7df0-40ba-95b3-540bf8c47b92", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327778, "uuid": "3941df7d-e7f3-4803-a18c-904501af3b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327778, "uuid": "d226f065-94e9-42f6-9d9c-adf3eab375e7", "value": "main.x86-64-v4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540ef7e4-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786371495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "1e7c345f-e107-4326-bcad-fb580d91a111", "comment": "Malware payload (DarkTortilla)", "value": "9cacca15cbfc830d6ac0329b09dff09a", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "03e8cc8e-27d4-40cc-b557-707e3e365848", "comment": "Malware payload (DarkTortilla)", "value": "5900d609e934ae7f84ec74764d6d108b584f77eed92c55f5e4f2606faeebd864", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "ed1dbe15-b3d5-4981-a032-17f63f71f1d1", "comment": "Malware payload (DarkTortilla)", "value": "959561b6d1ebf70c0871df7d64319bdb5c11b40d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "bc5c3f4f-1790-436c-8ad0-1c6ec7ed781c", "comment": "Malware payload (DarkTortilla)", "value": "3d5dc8581b3e034828747bb79dea72b324d07a866fb52b801cc3c6343baae0758c76ef4461975e90743dceae0ed70367", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "120581a4-c45c-4670-a98a-3fdb8b0e5d79", "value": "T1F935F1298DD76624DB7D4F78C0A648AC23F0CA9392A6E71F3EE910F48F527D5A917043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "90c05e49-7b1a-47ab-837f-166e33515782", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "2af629a9-d9bd-49a3-a911-1142ed2f95ab", "value": "12288:7jKpPT2CPpHAP/iGc1ZOM+FhWF2hekxpp4y/ZeGRpQ6s7Ewxz4RH69Vs:sb2UxAPqGcv/+Duyx4DiKnzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371495, "uuid": "257f8bac-a212-468d-8422-4737c6b8c0e8", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371495, "uuid": "6079f6bb-a210-424e-a52f-cba451788d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "696bec9f-0543-400a-aca6-9d38cd870ce1", "value": "5900d609e934ae7f84ec74764d6d108b584f77eed92c55f5e4f2606faeebd864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5b0991-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "8981cb97-ef8b-4492-b419-f6e3db8fc9df", "comment": "Malware payload (AsyncRAT)", "value": "2a1f45a5a55a001e68b8559eb54a7b26", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "e04749d3-39e4-4e44-8882-593abca85652", "comment": "Malware payload (AsyncRAT)", "value": "594192542dd1221ccb2f04f72d23c6e8422cfa87e7d41aaa10f1e16f1aba1035", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "4f5ccbc4-6d26-41d2-99d1-70a30e90720b", "comment": "Malware payload (AsyncRAT)", "value": "cbd45b80a084d29ee8da3692a6d5d342381cdcff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "17eefcdb-a21c-4a07-aad4-466cf7791cc9", "comment": "Malware payload (AsyncRAT)", "value": "f3136bf052f340debc12013356649457deef61f142576270ac2344bd9c2be7666f81aea81542a954c892abb1f5a5e7ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "eefff1bf-eede-44f2-99c3-1a6dfbbb2403", "value": "T12C15E06826678602E4B66FB00DB2E0B0577AADEAE532C2194FD63CEB75777107C05327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "725b2bd1-9d58-41e3-8ca9-4f85fe15f395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "248e7152-b8ce-4674-ac0a-c1e45a9d99d2", "value": "24576:gdEaWSn9mZE3xw5xGLIcUJRvgUFcYYUODMKeZ:gdEaWCeE37dax3Oze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373580, "uuid": "8d55c0c7-12c0-492e-9b4c-e3212b880359", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373580, "uuid": "158bdbe3-0e5a-4bae-8275-bbde37d72a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "6bc54bf0-c557-4f09-9dd5-7b93b8be8367", "value": "594192542dd1221ccb2f04f72d23c6e8422cfa87e7d41aaa10f1e16f1aba1035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a77464a-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "38cd517c-ac39-4a50-bb62-fabbff545830", "comment": "Malware payload", "value": "f783893045ef51e0141c70ae5aa199fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "c07614b3-e90b-41ca-833c-6273fbab1190", "comment": "Malware payload", "value": "594c42bacfe1f7159873262077f51ceed16be4b15c78ea981357d6cb959ccb0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "657ae170-b14b-4e03-b0af-b935ac417397", "comment": "Malware payload", "value": "a257f35a4eb80478db7b487a9fdbbf3ed67c99b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "ef0584ac-7c85-4846-b63e-0d419a552eeb", "comment": "Malware payload", "value": "a2f63a0ea7ab00114d2170e664fc1a5860907f6167ffe3468a36f4b770736d0f48e9686a173c20ddbf55b08318943d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "14136fb3-ba35-468d-97ed-fa0a15d2dd9d", "value": "T12045E1987142F5DFC807C6728EA4ED7465542DBA5607C203A0DB3EEFBA3E5879E140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "ada15c70-1016-4202-8ff8-3711782e7979", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "4665c43f-c234-484c-b364-f900f24229e9", "value": "24576:D49oHZw+NkC9o4Q+6QwjPJ3YaGjCdZ9Qve:89Qy+ZTr6XjBIHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371963, "uuid": "dcf8ae61-3d14-4c59-8ef0-3b4faa8f2dbe", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371963, "uuid": "c0e71fd6-50b4-4b72-b7d2-382164a529ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "283ad462-e069-4ed3-ab15-adfe6d4d3426", "value": "594c42bacfe1f7159873262077f51ceed16be4b15c78ea981357d6cb959ccb0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efd5255-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786373205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "78b33fa9-40e6-4c5a-91a6-1b68f3cce80e", "comment": "Malware payload (njrat)", "value": "4a1c4b526ea937d4f7dd7b892c3183b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "b4e4c5d6-1c03-48c5-88ad-5c1f5c29cf97", "comment": "Malware payload (njrat)", "value": "59afb3104b14bf45f5b8672c31ae96725427395fd0f7eb842a0eb41026480c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "65138241-37df-4606-b28f-84e0722f641f", "comment": "Malware payload (njrat)", "value": "e97e2de910c26da660dfdcfa9c96bc0815405203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "3b872b3d-369f-4471-bd06-24c682d7dac1", "comment": "Malware payload (njrat)", "value": "02a4d49da55401276ab80d3f631eaaf8fbcbd9e6d359dd9a5d67dab0772683ee98fb837986d4835748177f9755b56063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "12600950-f74b-4206-9f08-cabfd8baed6c", "value": "T17715F0442346E952E0DA87F2B9B0E37433654CCFB9D2D2D66FE92FF738187815958282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "6b0ae1b2-4203-4b66-8536-fe120ecfcca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "0b6734d8-4163-49e9-9878-71d7a44c99f7", "value": "12288:zrxxltnn0gGCrzUq/nqBpovZp6Eg8nsHG/KNu1aZxMKEwZPU4+5lVhw1XPJdo2:vp50i/UqYpoRzUH7u1aMKEwPinhwZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373205, "uuid": "35193aea-f5e5-429f-86c8-6df4643474cb", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373205, "uuid": "165d25f0-e77e-4c61-8159-8cd429e87366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "34d94707-7b79-4007-8b42-882c1a7fe173", "value": "59afb3104b14bf45f5b8672c31ae96725427395fd0f7eb842a0eb41026480c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0c7480-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "30a75b09-b2d4-4073-a97d-492d12296aff", "comment": "Malware payload (Vidar)", "value": "d50e022b61d0de214cd8bec4fb2196ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "a2c8cc48-79f7-4b5f-ba34-8cbad1a73094", "comment": "Malware payload (Vidar)", "value": "59d248d3cf52b5947f75aaacd646edd910b0c06a937a80788fbe4ea7f5dbfc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "81108219-c073-40b7-bdfd-9190b4f69fc3", "comment": "Malware payload (Vidar)", "value": "011b56d9a080ce9312bf8c41b69afdb5d603d9c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "7c4accca-6e30-402f-bda3-46fc1e78f67c", "comment": "Malware payload (Vidar)", "value": "d14166c148763aa7afe4f8721647f23c1ae1940574002a862aff54f27542b741966d33463d85da58366e243865e04a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "53dfdc5e-ac7b-4c1d-9a1a-151354d5f661", "value": "T187522B82F4D2C1F4C0BFD3389BB746A7AA76384012736DBF778D81A01E9262169783D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "e51f5f5b-4e48-4533-a27b-990d0a5a4693", "value": "b94dba3155137e594dceb5b549504f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "f8e52555-04c7-4582-95c9-9b21f49263fc", "value": "192:iY7KK7dOj/l2dRH40GSXtW+qxyHThRIiGZ0trTzV+YyIVKOr8KbZ/Ai3Vii:NYATHtYWzqqtrTzVryIVKwBbZBli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368177, "uuid": "c72142c1-6f97-43ae-8a5a-7f6e7d87aabc", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368177, "uuid": "df432805-3441-49ac-b0ef-ac65a63a8eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "d24a1ce1-5ae4-48bd-a4b1-19f511d53271", "value": "59d248d3cf52b5947f75aaacd646edd910b0c06a937a80788fbe4ea7f5dbfc17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8bd59e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "fa2892fc-2ed0-4f1f-abc8-d995198d9391", "comment": "Malware payload (AsyncRAT)", "value": "829393f19df1e8ff2770ecd3dcb0e417", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "c4313818-802d-42be-8687-46d1b3f97ca8", "comment": "Malware payload (AsyncRAT)", "value": "59e6303685243d077aab158429f8f407bb9b2cce3c3eb4fbaef5335afb5e61b4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "0b9b8858-5f67-435f-a9ed-e38eb5053979", "comment": "Malware payload (AsyncRAT)", "value": "b942992ff727373b8f72da13b81f44d2e8cce40b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "2a53d42e-ec60-4ab2-b847-e77ff0281309", "comment": "Malware payload (AsyncRAT)", "value": "a600511eaecd8f47558f3c43255d68c04d149a3bffa30f7fd085285ef3362e46a48cf25c9ff0284c137af232d291cddf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "7df73cf1-dcf2-4a02-819e-be7420174745", "value": "T1E90501586206D616D56483B80B72E3F8077D1EDAA810E30B9FD9BEEBB639F548D04353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "69a91e36-352b-47b1-a741-ee7a305a93bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "8b9fec41-403b-4330-a8a4-f8352fd90ec0", "value": "24576:deA9szFQgynqlXp4Tv1j/pLJ1eoieX52mv7qvY:UUszsnMCTtFio12mv7qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374145, "uuid": "6e0cd1e5-ae69-4565-8bc5-3098377a4e39", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374145, "uuid": "4159ad94-2c29-4dcc-b225-0fec7e39c0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "38dfdc71-0277-40b7-a218-63b250ec28d1", "value": "59e6303685243d077aab158429f8f407bb9b2cce3c3eb4fbaef5335afb5e61b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e992e96-94df-11f1-bd95-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1786382197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "1684162d-0790-49a4-9f5d-4b85ef7701ae", "comment": "Malware payload (HijackLoader)", "value": "11004be6526584606e56c4c9e0f61d6e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "086aa985-dc7e-408f-8bf1-cf30d3d08504", "comment": "Malware payload (HijackLoader)", "value": "59f39368894fb8e19301c62cd8346edd31085939c6d0e83a9b104a7fa8c0c56d", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "8301f3f2-7be2-4405-bd56-5f87ed44b1a3", "comment": "Malware payload (HijackLoader)", "value": "c843f8fab805052e5902cedf31567345bdab2edd", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "2d1874ea-bfbd-41a2-aae9-7e95081bd311", "comment": "Malware payload (HijackLoader)", "value": "69ac6b97590b5ee87c38462550251be9dbc11e02e8b7b3a185b45ba01c650fe0e4d16a59fbf5eccea633197f10bbee28", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "de6d6a7a-f690-4fb6-b7c2-c32d930041dc", "value": "T1C1A6334043D31176F5A62D395806D5008E1239FC50EF315B6FFACAAE2B71B91D83ABB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "4f6d8b7b-fdb3-4d99-912e-fb1f251ff921", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "7234d3b6-3acc-449c-833f-27218fb71f5d", "value": "196608:QM1gY4874wbUpZP8+xyETR+CPsNmChn93IVpdHCYdv3wtdkBqLxj:QM1gT8Ewbe7/dWmC19AEyIcBq9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786382197, "uuid": "2f613d7c-5e37-4fe2-af7b-894f74d16f82", "value": 9947489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786382197, "uuid": "1c97d595-3c17-42c9-b288-8f3db294d39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "d352f1aa-fe20-423f-a46a-7654d4d10a9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daa9d8e-948e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786347513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "c96dcefe-5b17-4e43-98fb-c7593b453a7e", "comment": "Malware payload", "value": "253657209d6d2c33d059ce4d6038eda6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "3e203b0a-2e7d-4980-8a47-79d8d67fec66", "comment": "Malware payload", "value": "59f5ebb14c5c0eadefaf4fa26448216e9f6bc8f746724b2eb395192befd5cf1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "ad4fb79e-6cc8-401e-b761-0cad255e3885", "comment": "Malware payload", "value": "db3bb14b89267653a9045705bf853a601f95c410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "4748c8c0-c50d-4814-ba35-0e93877a5de8", "comment": "Malware payload", "value": "6afed43ad2399dcbf27814cdb4be71ba5ff894efd9123e3ef505419b9838a81b93660de7a77fa70dab391024a17420c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347513, "uuid": "126c9a33-e930-4486-a1b6-d17c3a697087", "value": "T106333B8791B4D5EAC570AB37E557FBF6829BBDF484D84B1D0C88EB2B58B0B004724D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347513, "uuid": "62d46032-81ac-41c0-b874-725af4d4f776", "value": "1536:kYOAzZlOX6ZpveeDkyRpfKcSA8WIZc73PQRyVj:k/olOqyeRpSA8WIZ0Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347513, "uuid": "4850ae9e-dc5e-46c4-a238-201b2234fc1e", "value": 50232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347513, "uuid": "47e3d0a3-c808-4a43-88ca-5dc73cbd1f11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347513, "uuid": "df1fd364-fc4e-427b-86d4-66bccd0b9be5", "value": "main.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829e055e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "14a07ce6-9b37-4f91-a2f9-80a3980542fc", "comment": "Malware payload (Mirai)", "value": "8c51a95aba02640130cbdbb5d5603eda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "d791b55a-235a-424b-a866-0c56edffe679", "comment": "Malware payload (Mirai)", "value": "5a0185e4dc07ba2f6c94b43d83289e7de2b2ff7a2207247298fbc0b72cc1fa3b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "8b5d4579-fe23-46d3-94e9-d9d97fb61506", "comment": "Malware payload (Mirai)", "value": "9a58b442f8733c01699d5c90fde27f772f21a411", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "61fae6ef-6932-4d4d-be6f-47a4b165791e", "comment": "Malware payload (Mirai)", "value": "a66e679ba23b66c1d1b4d27e272f0269fd9d35be98f2cd9b73c0ef6249f6110737b4791f053e2acae11ab0680b8d46b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "0142e44e-739f-42fe-bc2e-45cf4dc8259b", "value": "T1B5B3120DAAE0A693C717E93D111D6331E00A5B8035C27FEB07A8D886BF30D559F6F964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "2e24e4f8-4392-43cd-8bd7-79672e391359", "value": "3072:EE2Xt171cbCXNqmC0kEecHnk6bO5dWg+jVIrZEETw:EEgtpNqp0kEvH9bDfgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383600, "uuid": "6b01fcfc-5ec5-418e-b00d-cc7c46214c40", "value": 107568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383600, "uuid": "8ddc409a-d9b6-4cfb-bbb1-d8b9d1db7d12", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "0bb19a3f-5cbc-407f-9842-64553f16de66", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745eb073-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "6827cd82-a029-441b-94a0-983b793028e6", "comment": "Malware payload (Mirai)", "value": "ab1b68a364221fbd7860a409fe2ea7ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "84499071-0941-4942-b7b1-54795d064690", "comment": "Malware payload (Mirai)", "value": "5a6017f3f905b8aca076fe8cdc10b4567cefe960d200e30f97dced8a9761180a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "8a450216-ca7f-427a-81ed-6f54ad0db493", "comment": "Malware payload (Mirai)", "value": "e451957c38b377f35b73dc987cb56c079d96323e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "f36543c3-0e1a-43e2-8907-ebb6da0df3e1", "comment": "Malware payload (Mirai)", "value": "b0d6436fdc2d94a4c9491827bc45f263c14c0dbcc0381ab7cae32faae0983b6006dc80d76dcbad022f079d5046b3fadc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340196, "uuid": "44496660-0e16-4f9f-932d-f822d84eeda9", "value": "T17A846C8842F5E6DEE2C8F47953053C166872393A3493F296350FA6BB53A62540AFDF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340196, "uuid": "2d31e529-d5c6-43e5-a35f-989ed0e38ff9", "value": "6144:v2sa9p1decla9dN55zIdybZKQF6Ufv1Drdp3UKck:v2sa9p1+dzP9F64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340196, "uuid": "cd671c64-f75c-445f-b10b-eb2d082a554b", "value": 396304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340196, "uuid": "1d2c2c06-041b-4ec8-b8f5-a19b3edc9be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340196, "uuid": "4f7b6586-f2aa-4261-88ed-26afed904698", "value": "vlxx.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7522dfe3-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "39aaab7b-a980-466b-b4a9-f7e6647d4fdf", "comment": "Malware payload (Mirai)", "value": "6d01cd8007ad4b23ee7470d9e0928834", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "b01e0d3b-6fff-4478-9d13-d2fb2b5f0fad", "comment": "Malware payload (Mirai)", "value": "5a73ac1265512d75eb2a65a941e062f680b3581c295ab13403d097f8cc3f40af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "af1d21e1-4756-4229-978b-6c7cadf2a31e", "comment": "Malware payload (Mirai)", "value": "06cc11260439c02b391fb3676ddea396011896bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "75cf0044-d61e-4ee0-b72f-605296e6be07", "comment": "Malware payload (Mirai)", "value": "fc8f1f1d4dfc03e54876947ff2f85c47b04722d1ea485a62d98830bd13a545c01093758e28ec8375bdc7149c9fc5e7b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "fdcc5ee7-32e4-4eb0-8b72-81325e538bf0", "value": "T14BF36D80F313E2F6D84704B0617BEB339A359556511BEEC2D374DF35EC62912CA1AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "5a2e4544-47be-4bca-8935-6c97326c3cea", "value": "3072:JLIxaXdi+w3/tQeFghXxBaX593ReY2aSrIvwPzQIC+:JLIxaXM+2/TFgdkRB2+wPzHC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356948, "uuid": "49a758c6-1775-49de-819d-754cca7c26a1", "value": 159360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356948, "uuid": "1e51c6f3-7d1b-40d4-9606-818f9328a979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "ac843546-ecb3-4fae-bb34-edc475decb00", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4b607b-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786372747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "8e148a24-2f00-4d5d-86d0-a60e00e3359a", "comment": "Malware payload (AsyncRAT)", "value": "00e069645fa04c1fb6c54d02f1eaecf3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "e6afdf14-b11d-4902-83ff-f3e58d416f31", "comment": "Malware payload (AsyncRAT)", "value": "5a83f8a2973445c7e801d8b470851a4fa6dfc51c776f8233c727c7fab9281fee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "c85709bd-5376-41be-a3ae-68eeb724e8f2", "comment": "Malware payload (AsyncRAT)", "value": "d68cde7896228b50914e405de3e82cc1436393d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "effd1fcb-87c5-4255-b4ce-655789e56248", "comment": "Malware payload (AsyncRAT)", "value": "31e338594db631911ebdf7335b6168fd5856365960e46e0566bc8ac8a67ae662d0cd36373f64e15bd3855ad4c477f938", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "020f9448-fa78-452e-93ac-1e7f13e785a6", "value": "T1A405F155121BD842D0D687B6F8B0C33433645ECFB9D3C2966FEA2FB7B91A7C25980681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "47e6dbd6-e1ba-44eb-84df-e8f272fdfb28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "8d883328-a088-4a97-b01f-e2eefe9b7ad0", "value": "12288:cq6xxltnn0gottMSu+X5l+ldszJmJKtLW8NA5cQh0GfKNZwVpOV5B8e8:d6p503tMZU5lsKzDt1NAGQh0GAo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372747, "uuid": "fb09538d-5027-4119-9765-3d5faa5781fa", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372747, "uuid": "8512184e-97d2-4255-b90e-e85a04e8ee66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "8641c789-6638-42d8-9f11-c4a7f7db2062", "value": "5a83f8a2973445c7e801d8b470851a4fa6dfc51c776f8233c727c7fab9281fee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c63f821-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786368449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "34dfcf3b-45d3-44b9-b15e-ca44a3f98c8d", "comment": "Malware payload (njrat)", "value": "663da4a53a92bbf3688ef7d91bf3fc4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "927197b7-64fb-48c6-8f5a-79bc20f4ad84", "comment": "Malware payload (njrat)", "value": "5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "8d994c41-6456-431d-8e3f-2adb8abb5f08", "comment": "Malware payload (njrat)", "value": "46c9090f45a74b0e2fd54ab0b70b2250f9bd1271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "ea97bab6-b7d4-4300-9adb-b176214f02d2", "comment": "Malware payload (njrat)", "value": "6d5fe456b07f2a151cbb67fc629604ddb71127f29f797e4a91759d39f58fe2a7b180dff7579a3a1f3967e0ff5310a1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "f892c172-48df-4aa7-b391-3080c72bfc5b", "value": "T11205E0D03739BB05DEB41A319974EEB583B92DA9B420F9D61ED93B9B346D2005E0CF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "2a83f2d9-2489-4270-a428-64dd1bd2eac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "a6cfe4e5-46d6-4c27-bda5-b604ae5a797b", "value": "12288:L/PNKL9lQWENV39tdbMlqJ05w8evudkglK6hFhR9KbHiZagI6nFP0h:RHdDdjCwSdkR6hZAK5I61q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368449, "uuid": "7f88b133-c17f-4c63-b581-225135232d90", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368449, "uuid": "8ed26bc3-3bfc-4e6c-8ec8-57d8324046b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "6cd599e2-0a4d-4748-be8a-fd37f2f6009f", "value": "5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d19d156-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "3ceb2ba5-4b76-4c24-82bc-c40dd3075ad9", "comment": "Malware payload (Vidar)", "value": "2cd298d36fb6f5bebdfef8501b9b47a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "3f496ab9-cadc-4d80-962f-50bf03d83719", "comment": "Malware payload (Vidar)", "value": "5a9dd3ade3194c8459a3b03dc0280ac98e10fb8400682c99e5707f9db9148c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "12d9cdc8-ffad-49e8-b411-785ef2f09dbc", "comment": "Malware payload (Vidar)", "value": "da2bce712ca46c7a704c3c390c5299dfe87997b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "c86d87e4-99ff-4b71-b2eb-0c703bc46199", "comment": "Malware payload (Vidar)", "value": "3b2a28c5b98ecb219a91046c7c6d29fbd5552e308a5851056514912b935ef3b53de83c4cbfd3312dfaa088760bdb66de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "0eba3a47-2d4f-440a-be8e-01d22111e86c", "value": "T10B52F8CEB28BB1B8D32E857DD707227BC71230990A195FFF1AFDD990368251079B1A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "6a84f2eb-049e-4e55-95af-add5f1e48758", "value": "bb652ddbfc6d78f25974f95364fa638c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "cc4531b8-dd27-4897-a074-f82862d84f93", "value": "192:WfB8GX93owObc89N3okwDNCPpTQaPyYsBZ1tx2AFMG+ER2Te3VfA:WqGXQbc0YbNCPpTK9BzFvFl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371001, "uuid": "8399ee24-d412-4ae1-9cb8-f751702b0271", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371001, "uuid": "b2ea601b-4414-496d-a5df-918fb2cc4b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "f46541c7-3114-4de3-8851-c51577970dd5", "value": "5a9dd3ade3194c8459a3b03dc0280ac98e10fb8400682c99e5707f9db9148c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65a210f-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "3da1b4c9-8e1f-4deb-8df9-f935d48f36d7", "comment": "Malware payload (Vidar)", "value": "42cf1045a0552dd34f3753140900232a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "d87743bd-c732-49fc-891f-1c444ed280ac", "comment": "Malware payload (Vidar)", "value": "5b480ce175fc479dd01496b9a47a166a599a8f26a6406dce8a036ede8cec8608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "f4ce1211-60b7-4cf1-9289-293d4525b0ed", "comment": "Malware payload (Vidar)", "value": "510a03fc5a1b8abe740bdcb5d2ed3b5e5654addc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "ce24f87a-f8e4-4858-837d-8d6bb9d54fca", "comment": "Malware payload (Vidar)", "value": "a309e23cc0549162453e3339644b0bd91e97fd74555563000b1c3114afe1c60c752473af5350ea66743edf0f9c6c5fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "1fdec94e-1dee-4913-bf7a-83d6146365d7", "value": "T12762F98A71D361B9D1A9C27CEB5A627BD766309E071A1FFF69EC874423824013AF4760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "cd284fe3-8c52-4da7-873f-b96c10df8a5e", "value": "44c0a950cab1227af44f555aa5a62d98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "e6218aa6-e056-4d2a-be58-b1b0960f09f9", "value": "384:O04oK3mBYtqzojPNQg0CeQyLpbu6oLAlNR:ocGqCNQSeQ4k56N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369513, "uuid": "0739ffc4-fbe3-4798-bb4e-9d77a347323b", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369513, "uuid": "d7797b7e-d231-468c-ba43-2829dc62dc96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "69d4b042-116c-47d2-9daa-4f4b365f3ffb", "value": "5b480ce175fc479dd01496b9a47a166a599a8f26a6406dce8a036ede8cec8608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ab0aa7-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786355630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "b29a8dc4-ccd0-4d47-bff8-b575a19626b1", "comment": "Malware payload", "value": "8d62f8e9816ba795639e43d398cab820", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "5d8bdfbb-7820-4e7f-aaed-f97bddacd03d", "comment": "Malware payload", "value": "5b498739ac5dc16b2106c966ac3ca89942a7a5d2b69f9c56cf392aabaf9498a6", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "5e7772d2-b061-448a-bd52-c1b7ec6cf489", "comment": "Malware payload", "value": "967aba10ebb5a745ae7a8ef6660e9b7bb49fce72", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "ad72275b-8915-4c9c-bc2a-9665daa02e4b", "comment": "Malware payload", "value": "54567ce7d3774c673b032b8ac9d0bddc4b3dd6be54632614e98c0668bb30bfbaf7904aa7575b3db7f5144f309788b9df", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355630, "uuid": "b0ffd4cb-9154-4cf4-a3b7-3cee380c204e", "value": "T1D4E4BF05B3D1D956C75787394DFAC6442A76BC124E52870B3A8D7F2FBFF26804E81A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355630, "uuid": "a0a840b0-1b2e-405c-ac22-cfac526f3465", "value": "12288:6KpUdmZHcrlQkLZpVPKj/tGeAYiL/7ZLW0Vvizd:6Kf9cRlKj8eAY+7ZHvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355630, "uuid": "c88bc422-95ab-4d95-ba6b-e490101655a1", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355630, "uuid": "614b9a78-9f2c-4d93-b42d-129454ee3442", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355630, "uuid": "b6b1b21c-d249-45ee-ac5e-fb7c237f0af5", "value": "09-08-26 weekly BDO ATM Payroll Converter for BOB - V3.0 - 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d17615d-9464-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "b872ed98-175b-4d68-a7de-209b877ca0b0", "comment": "Malware payload", "value": "be5c401d86413cfa764c91489405402b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "9a645a31-cea8-4bb1-adf6-68396d769b03", "comment": "Malware payload", "value": "5b54849bed4c6a637854032d9d8b941548d819ed7243813723ddbe3156edc74f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "3f9d1172-2b33-4aa7-b76f-20eab8452419", "comment": "Malware payload", "value": "ef1050bc498fcf0a6e1fa5f6838afaf54de7c101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "7701969f-caa0-418b-8a18-a0d1c980e328", "comment": "Malware payload", "value": "869d8121d4e1a0e37bd7187cc15b79a730eefd1dbff4bb2566c3b0e5f9b60a08bee242b1338fd4780a06770a88327563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329474, "uuid": "64f9289b-5657-4228-9c3c-0c062c4938a9", "value": "T1F325BE533BF61465D7404A358FE2D320B24ADBA934D54A4B9F508EAFDF032651E82CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329474, "uuid": "d0c2fa51-aed6-43f9-8d05-fd85c9ef1327", "value": "12288:NighdbJ5uMWro2BEXkXCFTrdnW5nAyda5g6eSJ:th9bLUsFW5Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329474, "uuid": "d99afdaf-736d-4ce5-ada6-843dca516662", "value": 1057088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329474, "uuid": "84bb448c-6b39-4338-b8fe-c4265e37457f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329474, "uuid": "dcaaea71-aaa0-441c-8f71-31a1c285df7a", "value": "main.sparc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d03de3-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "4f8b3f69-cccd-4afa-b4ef-a2a01bd58ab3", "comment": "Malware payload (Formbook)", "value": "b67879e61b809814aa86b3ae612b3c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "6686f78b-14d5-485d-99b3-d77ebd86d848", "comment": "Malware payload (Formbook)", "value": "5ba7f09d6a20a5c462a5852db6fd3ee719a35952752c654178c2beb564062fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "0d5a9bf6-45c4-4ac8-8b4e-a662e3f53854", "comment": "Malware payload (Formbook)", "value": "10a054bff831e107a764c248c623c3d52f1fc096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "98b3d936-f067-4a84-9724-3fe0a55af20d", "comment": "Malware payload (Formbook)", "value": "70803d2e1a0fc221d4e2ff483778c709503e132a01b1eb66797f240395efc08879793758d7881ac1d102614e524467dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "2f148865-8d9c-4c4a-805f-d01be8e4700f", "value": "T1424512606614E716C51867380AB0F3BA63F86EED7900D346DFDDBDAF7932B014928693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "d937f5f9-674b-40ef-a2f2-e58bb5d666d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "4b7078aa-2bf1-4fc3-87aa-5ceaff6dfbdf", "value": "24576:pV/+ULCX9PIHg31HPy23N4zJimkoueiTPX169D:9Lub31HjmzJimlueR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371257, "uuid": "71accda1-ee68-4381-bc8d-3dc314af4037", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371257, "uuid": "04d99666-3e6e-46c4-a8ce-dec01401f1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "636b6d97-fec9-43a5-bf7f-437eb3e87bb9", "value": "5ba7f09d6a20a5c462a5852db6fd3ee719a35952752c654178c2beb564062fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415f7582-950d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786401958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "24abe338-aa9c-4ce8-a4ca-9631be1cf614", "comment": "Malware payload", "value": "7d9888e5aaca0d7af493997815700f61", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "f3fe6867-7268-4be9-99d4-34df3986c0c6", "comment": "Malware payload", "value": "5bb16c59b51e8d7b5ecccd686d7b75a0a1ebc5539609f489de6064c47c1cfc7a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "532894d8-70fd-421d-b61e-0156dc031c33", "comment": "Malware payload", "value": "cf19d5ebf09377432f3cc38ad94f8c7e0c5222d3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "4c8b9713-9eb4-42b2-adc9-2778f7fdb0a8", "comment": "Malware payload", "value": "65414764541d273339251edc0223e69a572b7a67984cd98bdd0c74e1e54f2d413c29388fbfb2c66c9c0e4a5bb720978d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786401958, "uuid": "de5d63f6-6f65-41b4-9fbd-126175128c5b", "value": "T1F142F99CEED172B0F31303CE77AB2929122461D72008C5C5F98C9DE57F467D88666A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786401958, "uuid": "bebb4c84-b3e0-44e5-beda-f5a88b4b6c1b", "value": "192:sGHNsGeTHQpD+da6+888+UV7tDoj/pxzaW5JYb55qr5HdUIz4CthO5Hk:sGX+/DV7k/3aW5WfqjUg4CTO5Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786401958, "uuid": "31df1d93-427c-45cb-ac4d-c5404d900dcb", "value": 12227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786401958, "uuid": "8a9bc485-91a3-4c8c-988e-5ae61a14e019", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786401958, "uuid": "f8055c92-0e86-4582-b78e-78163716588e", "value": "fuck_niggers_8.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834f6ad3-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786374152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "0f635a5e-ae3b-4133-bffb-c6c2b8538e8a", "comment": "Malware payload (PhantomStealer)", "value": "f0dbc760a3aaa11bf81363c6af0cc884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "b31e3b11-f547-4a4f-ae76-f5157fff19a3", "comment": "Malware payload (PhantomStealer)", "value": "5bddfd79c9fce9b9a38f93cb83eecc1571de4bfc78e0dd276945e4e40417a5f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "810d382d-4a91-4ec8-bac7-3690e7009498", "comment": "Malware payload (PhantomStealer)", "value": "18026fa711df2b9198606ff68f481a5c0d353641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "4edd8e5a-2cb1-44ae-ba3a-a6e1920c0052", "comment": "Malware payload (PhantomStealer)", "value": "e8afc8335995644bff4789444c23c10717d321f3c53b8679da5c6b9febf92829cbb6684814ba23c5a17c2d95a13719c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "8db54752-90aa-4ad2-87bd-b62bf7f6e7b2", "value": "T1D37512882612EE06D58553B80BB1F2F48B394DEEE410E3175FEAADFBB539B244D04653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "dfb03e60-d617-4dc1-8642-3ec4fd5eaa45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "7977fc12-286b-4f62-9ed9-47b821235b4d", "value": "49152:sUscL3jAR4lytVPD83KLeIcwZUp33R1wH4G:sPTRgo783K3ZUp33R184G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374152, "uuid": "487d852b-0620-45fa-820d-46aa88ad466f", "value": 1580032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374152, "uuid": "81568868-b5d8-4244-b872-afec4e10bed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "216c376f-8d2a-4434-9e6a-e16b114d95a3", "value": "5bddfd79c9fce9b9a38f93cb83eecc1571de4bfc78e0dd276945e4e40417a5f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e1dfa1-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "05ae1a21-1a51-423c-abdc-d6abef4650d1", "comment": "Malware payload (Mirai)", "value": "2a0ff6df487d9fc92766be98bd310d13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "9f0f220d-b166-4bb8-879d-529a3c567d1f", "comment": "Malware payload (Mirai)", "value": "5c2344f30999cb0ada70828adfcdb7efc1d757f76a7f912fe6f1ab9ab3b743dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "3a97d308-6ce3-4532-9f4f-948411318051", "comment": "Malware payload (Mirai)", "value": "8ec4f3f1ed17f88f6cb00e1dee415135eb3849dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "d5f8296d-d5e8-4cf8-ad76-353bbc55a9e5", "comment": "Malware payload (Mirai)", "value": "d3cef950c8fb7de9828b41bd8543f6a7f13c9293ccc73935d81bbcaa9db70a722f99fa45ededdafa389c5f9b00c70e80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404630, "uuid": "085fd7ec-86f4-4c4b-98b3-f50104ce36a7", "value": "T113530A89AEA11BDBC46FCE70453E031726EE485F62E27336457CDC5476EE2088AE3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404630, "uuid": "baf3593b-55cc-4730-80dc-ca9e8bf5239d", "value": "1536:ruAGSjhql8FY48NzK3P59sVN1mjWrN6+DQ4pLjfR3:ruAGahql8FY48NzK3PsVN1jo+Dr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404630, "uuid": "cd20f8dc-503f-4bbe-8b8d-bbd30a9a855e", "value": 64876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404630, "uuid": "4db22b2c-af2c-4654-9678-dd1d4df9d28a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404630, "uuid": "7688a0a9-e8ea-4f60-91cd-249130048cdb", "value": "mini.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c33cbc8-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "8587b164-06b8-4ad9-ad86-0c8c8a97d284", "comment": "Malware payload (Prometei)", "value": "a19d933d23e188f44f87e6cfbc79754b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "43806471-5a92-4e27-9ac8-1c0c66540a37", "comment": "Malware payload (Prometei)", "value": "5c5575b228ce5c6f5cbe7dcdcde823a6ca926665f345adc585c8cd6df4f89ac0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "9c33e0d2-cac4-4464-9d69-7a03333ce62d", "comment": "Malware payload (Prometei)", "value": "22469e8745c819600b8d0fcdc88b3d9fc22c2528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "782d6618-68b6-467d-9bb8-358124f5325b", "comment": "Malware payload (Prometei)", "value": "99676e0f19d660b4f6b184a016dc84885a25cfe326298c9284719a2b2500ee864cf11ab2db6b83a764ef675e9937a5d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327781, "uuid": "da10d8a2-ac9e-44de-be9c-2d0da9e603b6", "value": "T124167D2BB2A354FCC15BD030979FD673A835B4F801317D7B26809A352E72E605B69F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327781, "uuid": "6f0b6952-a148-4e75-8572-90ff79f59184", "value": "98304:rOMUTZs37lmhsUoj+o/mcITAVyDBTz3NehBwMBvZgV:OsFSTz3NehnBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327781, "uuid": "87be59d4-baa1-4b18-b57c-447d0799f4ab", "value": 4205848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327781, "uuid": "64418bda-93a2-4fab-8d48-152c1ae185b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327781, "uuid": "22ce1c36-611f-444c-a101-b5209d7c2302", "value": "0ca3a4c2800f9454cdcbb8398a7ec97b00f90f4234c7c5e48e206a8352d86750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad0d4b1-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "e8843dd9-fdaf-406b-90da-6b0ade8d862b", "comment": "Malware payload", "value": "1c1cec16acf30bb3680b9c77d5959539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "13f07115-fc57-4135-ba11-d77cd2b412d9", "comment": "Malware payload", "value": "5c6c49e8e282bef4c70c9decdd1e2100adae553b2c0a0d99dc5a121e93321ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "a8f6647c-e3dc-476c-9c5e-a0f7c151de0b", "comment": "Malware payload", "value": "ba3fcda1582830fff9c433d0feb1ef835b5b166e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "fc6f0a54-9358-43bf-8913-36c0b50b8231", "comment": "Malware payload", "value": "4ed6cb00c2047a3809274f0cca5e95258d8a868f2d9494536e606bee755490d6d640a77a3dca26986ac2dc5f0c21ac4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "ef7cf4b5-1119-4ca3-ac5a-93b462f921df", "value": "T117C40245E95FBCE9D83A42F48577850A2033FDA64878651F0604FA3A3DB75C3F92AE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "6debf6ac-c681-47e6-a13e-15cd95560729", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "ab51cd86-d783-41f8-9a1b-6a99a0e848a5", "value": "12288:M70ZBbkmxoIV5uA9iRN9CWa2k6bwaUwyWMEEzLNYE2Dn/q5f1:M7sbkmxFV5DiXeAweMZLNX2Dn29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372849, "uuid": "f68285d5-5b73-4dcc-9565-0f96a44cf3ca", "value": 564296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372849, "uuid": "6107ba54-f557-4a14-806e-c58eafa756f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "4aa6d6fe-0ec1-4064-bcbe-9d78380799e7", "value": "5c6c49e8e282bef4c70c9decdd1e2100adae553b2c0a0d99dc5a121e93321ccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36373924-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "db7cea20-2bcb-4768-9c72-8a82fca56efa", "comment": "Malware payload (Mirai)", "value": "7343f1b1370ab5ce0565d05ebd4d2d57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "47db29bd-0e0f-4356-92ca-c1f62fcf08ec", "comment": "Malware payload (Mirai)", "value": "5c8b11a39aa0cefad77db32d13bef0a3968bf7f0a4f439d346cd5a625850caa5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "7ec0f2b7-5095-4010-85ae-3eb972236110", "comment": "Malware payload (Mirai)", "value": "b9613c0a53e7b3d0c68b238367d3d3e72919dc05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "ebaf78d0-cd7b-4d36-8521-acdeb81dd120", "comment": "Malware payload (Mirai)", "value": "b850eef204c66c0f475858fe60da35a0b53071939cbfa153ad8a85d19bdfd978c032537e6e451db36342def7887ebee2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "3aab5d92-1ee2-4999-b03c-f56b2386a5ba", "value": "T170835C2731395607D0E1E1BB11F74B22B2D20BCE6358D28EBFA20D9F9E153506A66DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "aea7b915-5a62-48c0-bc5c-69beac0278fd", "value": "1536:oSSpuNyJHa2glVXcyGDxyS6DLWR/e9OsodPSwwhsfiV09bdUJdOoi:oStNHXMFP1S3pGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356843, "uuid": "b03f2c1b-8895-491c-b0b0-279f82f1012f", "value": 86444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356843, "uuid": "c23612de-a908-495e-8477-a5a4d92a2cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "cac7c40e-671b-4036-b121-c1d0bedcf7fd", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d85587d-9471-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "e98cb4a6-4901-4708-8529-d12d8e828785", "comment": "Malware payload", "value": "68efd585e5ba88f56da05ca6fd7ee7a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "151c5b93-c2b4-4653-a2cb-dfcdbb41537e", "comment": "Malware payload", "value": "5c93a036c695dfba618e2df0dcdd28be50a352f1f7fea01803298a6876e72b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "da2bcb45-9104-4fe7-9dcc-7d4d50b99b38", "comment": "Malware payload", "value": "90d763c0d5b7c22f92f8147b83beb0bf193e0698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "d6dfd215-cd93-497d-8669-bc030706ab24", "comment": "Malware payload", "value": "dc022049aa2a7b3e3bc7c585a5e4c11c5934d6f7af93a1f74d17f123dbcdf1a861b1b49e3cc9f0042aa3dcbaae2b47e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334924, "uuid": "e7fc2388-1af4-46b9-be45-421a291127fc", "value": "T1F7055C12FF4C6417C70A06B0A56E5B7CFB52745381F9C6033B0866AF64D233A5DABE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334924, "uuid": "6d1153cc-2749-4136-8d2b-8b2475608549", "value": "24576:4/OLQs+mAVdT5KXrwfIVl+lK4Xa3UYYYvg5xq7g2/rpKlG2dPR97:4/1mAVdT5KXrwfIVl+lK4XIvg5xqU2/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334924, "uuid": "806ad8e7-5c14-44cf-8c6b-b7effa6b7e5c", "value": 860392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334924, "uuid": "4a7d794f-8587-46ea-b14d-69874c1ebcbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334924, "uuid": "2f26c644-48d2-4a6c-8388-3e24793043ff", "value": "5c93a036c695dfba618e2df0dcdd28be50a352f1f7fea01803298a6876e72b6b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd8ab6c-946a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786332236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "7101b0fa-e860-46e6-9cd3-d915bea5b850", "comment": "Malware payload", "value": "b17305e149026fb6131f23377e58fe5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "a0192f06-1767-40d8-89b7-3be5fd53f60e", "comment": "Malware payload", "value": "5cb992f1861f3d9bee208f597f9925a3eb7a5bc4d482a219b5610ba5dbc4fc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "786d1c19-7236-47bb-9d9b-2562b8527ccb", "comment": "Malware payload", "value": "967901c2ab0654609ce088950380cac22ee32300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "f41e13b8-0643-4957-adc4-ada7e22bd81a", "comment": "Malware payload", "value": "c80cebc726dd7dcb11af54026303703fbba3af530f146f21dd11a9faafe5c54a9ce6d889cffe75070436cb5d2fbd98b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "0fe48b75-3836-429d-abbf-6975932ef245", "value": "T13BD52398B9FB19B4C473CBB68F47F0BDB02577864B918E03F68D6A109D12594A93B730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "72468cec-d94d-41d9-9255-23a70839d5a1", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "6660fef9-e451-49a3-88db-bce7980f4ec0", "value": "49152:Jr1vz3JnN5QKDdj9vynhTq1y9cp11pN/5RN1w3H4MaQbPh:JZ3NNaS9vaY/VPNK3Y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786332236, "uuid": "151b0092-0835-4fba-a3be-1bba621bb7bf", "value": 2917376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786332236, "uuid": "776f3cba-3c46-43de-8c7f-953fe888bbce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "32992b8f-d9f2-43e2-92aa-50daf9ed13c1", "value": "5cb992f1861f3d9bee208f597f9925a3eb7a5bc4d482a219b5610ba5dbc4fc1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e35496-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786370507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "7cfa082c-0d79-4ce2-a7ef-210ecb27a5e4", "comment": "Malware payload (RemcosRAT)", "value": "762bf3c0b46f6fb04058851ac823f923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "a735af5e-6099-496c-9997-3e400aa8bfa1", "comment": "Malware payload (RemcosRAT)", "value": "5d13cfc9ec95b80219e759f945661eb22e4781df28a181474a040dc72068562b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "3ac9f94a-5753-45c1-b94c-ffc5a65b89b0", "comment": "Malware payload (RemcosRAT)", "value": "f1a8c046a026526efb2731c711bb31e834a0a5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "22dab475-0b9a-43c0-a55e-f1353adc3f8c", "comment": "Malware payload (RemcosRAT)", "value": "40bb6afeca06301fb99245c7bcb120fad711c745b39f7fc88fa6e6645583cf5df153c913da01b160b3f50f1e51032bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "ed672da9-0edc-4414-9170-ee1e98a83ee9", "value": "T13D0512A46E1EDC12C49327B44AA0F37523A95DD8FD59C2229BFCEED77C29D0B6C08950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "97399d5f-f4fb-4447-8808-f3f2d3203996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "4c46be8c-0820-446c-b3f8-0c19e95d002b", "value": "12288:2WpwZqv7MmCWWBr2XkxkhEQSi7kCRcXzP8GfaJ/pQhf7q4:xpwgv7MnBCXk6EMYCIE5lIf79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370507, "uuid": "707422a7-2961-41a4-b94f-dd06b03528de", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370507, "uuid": "d74411bc-e549-44dc-8820-e06166c1281f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "330f44b8-a507-4a9f-8a5e-d6ef13d512ae", "value": "5d13cfc9ec95b80219e759f945661eb22e4781df28a181474a040dc72068562b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa678d7-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "8cfeaad6-9d29-4d1e-b190-11a8ab844f72", "comment": "Malware payload (Mirai)", "value": "2719b7320d322742ada0faf8d9689270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "39cb2057-559a-4b2b-a77c-3b26550c6fc7", "comment": "Malware payload (Mirai)", "value": "5d30e09fd80ce4ba08374d63c94dc2e12e1e059fa75f1c4151ac34bd9ccfd92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "94835368-6a15-4fba-ac12-8b09d9655c8d", "comment": "Malware payload (Mirai)", "value": "c8985ebc5c4abf90d8beafce2b0477398087eeb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "cbd52b12-366d-4425-8610-7d7af75ae032", "comment": "Malware payload (Mirai)", "value": "e628b25af27e60fb63bff3b313819c328ccf4c167ccd6d44a078a93ffed060255edf958f1f72d6fb13e1e8917756bc2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404631, "uuid": "87ed6203-4113-4471-b7d6-18329de981a5", "value": "T17403F841759184FEC05AC2349B7EE52BE932785E32317A5FB789BB351E32D301E0B691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404631, "uuid": "ebfd1847-808a-4b73-912b-c8f2976d71bd", "value": "768:zyLTIgJU9KXhS5bY6ho+97glpTYTCicKrem:zBS/2bY017gllYS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404631, "uuid": "60f29f23-218e-443a-8069-3ee2dcc90887", "value": 38760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404631, "uuid": "75f5f5c4-c26f-4d2e-a145-07c3a2a2c084", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404631, "uuid": "2d0b83ab-660f-4a9a-bd99-7de94b190904", "value": "mini.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cddc960-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "ad6f656f-589c-429d-bc41-9bdd053b0130", "comment": "Malware payload (Vidar)", "value": "d18005d989a63244921843939da6ef2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "cf6c91af-2e7d-47ce-8375-d26b104ef737", "comment": "Malware payload (Vidar)", "value": "5d6658f6472e0a13c142496c831d215016a3f141c580a1a679eef43bde834136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "e0d30cf0-de62-483a-a2c2-41614375fb2a", "comment": "Malware payload (Vidar)", "value": "5f25f27872e5191af5ce34312c56bb4aac3ee521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "2fbf5b4a-840a-427b-bccd-948a5b33e4ad", "comment": "Malware payload (Vidar)", "value": "7ac5c92ed5e21ff11d35b9062e4ae09d3846171fd68b6324dd73b7db2e6ca98d6cb97caaa6cd83a75da0d2b9dde72265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "640bc425-b049-4956-953e-ce5f62c22602", "value": "T1FD927145E0179AE4C4E6C337A76652A765FCB8603136673FABDC9A3A0D52330A7403ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "0e5e1f35-dd57-426f-ae84-395ea3f92996", "value": "6dc49e85762e4ee01dd5464c00241541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "b528d6de-b788-4170-a301-56b2db0325d3", "value": "384:OJRE5NPItXZ2CyX5Bg19xP+Ma4RMsZF4rKl3lOO:62rPasBg19xPSoOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369255, "uuid": "80a965cb-4b5c-41cd-a5d0-6f1c7d1f83fe", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369255, "uuid": "d5079b44-2914-4423-87d4-f0456ad93bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "945cc126-87c7-4965-af5c-d915f0e3e5b4", "value": "5d6658f6472e0a13c142496c831d215016a3f141c580a1a679eef43bde834136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fec0427-9497-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786351383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "b0431a34-6805-42d5-b5b1-75758185aa5b", "comment": "Malware payload (Formbook)", "value": "59e90d4e4072484541636b873c35a4a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "9ce57e86-2f01-4385-b48c-69560057d050", "comment": "Malware payload (Formbook)", "value": "5d8353255bc5b09aaed218f2d6f016ceda78354cfb1a3f0d36d939d142f3a8f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "05181cc3-a244-42ee-894b-708e61f6646a", "comment": "Malware payload (Formbook)", "value": "673a985979c3381c4b1b5103816a0a2a11f29bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "6009c864-58aa-4b25-8ec0-6229a4dba0db", "comment": "Malware payload (Formbook)", "value": "24bad2f0ecaadf5a33036dff6124ea63e384e86c6231622e1b5b2c5a55129a1fd38b8754ae8bedf89e74d9f53848937b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "6a4d5be1-edb4-4e92-89f4-d5659b09557b", "value": "T1DD350254236FDC13C0934B7848B0D7B4527D9E88A852D3079EFE7E8775AB79A2C482D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "a44e14da-3100-4563-ab12-eab398b48e8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "8b272d1d-5c52-4f30-b242-729a2ad2d28f", "value": "24576:JgrWvYQmOOlGWiSAGhc26YxZ7sHMie+z3kdz:JtAYaiSAGGqlsja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786351383, "uuid": "fdbbd9eb-41f3-457a-9184-f2f6c7a8e92f", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786351383, "uuid": "4a9c1309-ed18-4c4f-b5ba-5e8d54250a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "a2082bd8-ff37-429b-8820-b6706c254385", "value": "SecuriteInfo.com.Trojan.Inject7.763.23737.20123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce2914b-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1786372316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "7cb7fe16-2617-4e8e-a08c-90761875cbc9", "comment": "Malware payload (Phorpiex)", "value": "cc06b4c7fae79e0b4977f26b8883e62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "2f50ef51-e9f1-4471-84f0-2c997d6d2938", "comment": "Malware payload (Phorpiex)", "value": "5d8fb52c70211fca8f75e26173d9a393b76a23f446c773f1238ddd7213756aac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "f31ae392-9234-4e21-9ec2-0faffe64b36b", "comment": "Malware payload (Phorpiex)", "value": "a7b1868b14662daff4e7f3cafc54eb1c9785d37c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "2103bc6c-283f-491e-8212-7526cf7690f0", "comment": "Malware payload (Phorpiex)", "value": "8d2b5451bb0100d1ee644d6930f4aaa71cb727858f1b28a5c4626a0fad161ae79fa2541ec04467ed64c2f039f7a04bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "62a13105-61ad-49c7-ab6d-9eac15f8bdb8", "value": "T12E55BF21B69790F3D6563A7014BA2B3F9E3DAA460F15CBC39364EE2C5C321C19D3715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "bbe43c2b-7a72-45ec-a912-f6535d3916ae", "value": "4ca36c0623611345ee5fabf3cf68d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "59b5d13b-d0ed-4e27-a991-77966b44ca52", "value": "24576:TlNV2ZTHxI0xvmodlG4u0sfOa49SkQwFn3nWBWic9uRCU7r:RNV2Z+0xJlG4lwd49Wmtic9Kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372316, "uuid": "322e9228-e6fd-4dfb-af9f-e24ae114d564", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372316, "uuid": "6785af0a-a6f4-4776-ad9d-3d3a6f6221ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "ec45885a-1225-42e5-91fb-a0701f606880", "value": "5d8fb52c70211fca8f75e26173d9a393b76a23f446c773f1238ddd7213756aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8f62b1-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (LXKeylogger)", "timestamp": 1786371428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "c440fb9b-7bc5-46f5-ac9a-129f013bedcb", "comment": "Malware payload (LXKeylogger)", "value": "10b6c33de8cbe29c6991f3e814c58b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "25f3da72-a192-4ea4-9d60-2301e308ac32", "comment": "Malware payload (LXKeylogger)", "value": "5d9386cefd8e46a8731b990925ca01c5cec5bc1dd0b46e4f81ef83fd5a308407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "cfb76430-70f3-4a8d-a091-df89a528feea", "comment": "Malware payload (LXKeylogger)", "value": "71f1c5e8a1256de7aa66f7bce95f38df81b041b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "a35a1041-2294-4657-8b80-373d4155fd03", "comment": "Malware payload (LXKeylogger)", "value": "c6b48892f2ec18d340e2f62891f0d5fcba96d5ef6d0333dd423467de7102ea42dd7d576444da62c7aee492e9c6568fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "02ca737d-5d71-472a-a0de-4eff35fa3810", "value": "T172356B0573A441EDFEABE4768B13C617C7B278450237961F06A06A766F33BB16A2F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "771c3dc0-722f-41ee-a0ec-9bf4d1c93cdd", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "102402c1-833b-4db1-ab1b-75df56148bc0", "value": "24576:mCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrE4H4444Ckf:t1H4jR2TYrQbDTrE4H4444Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371428, "uuid": "40f1f2ae-7308-4823-9baf-58be654fd947", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371428, "uuid": "8128249f-d9fc-4d0b-8b56-46818912b0e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "c6def4c7-f93a-4e64-8c8e-293950f9f7b0", "value": "5d9386cefd8e46a8731b990925ca01c5cec5bc1dd0b46e4f81ef83fd5a308407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c10751-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786374100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "690a13d8-47bc-436c-ae6f-0cbe96254d14", "comment": "Malware payload (GuLoader)", "value": "9bbf2c2c831baf0d97f36cf097885e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "159ddd69-34da-4066-9c8b-848e05157c17", "comment": "Malware payload (GuLoader)", "value": "5de6bcfc6e324816d9b4c7363785e986006395b14d707ddddd3229f249f5b1a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "820d9e61-694f-4a06-9559-511d0b25e0e3", "comment": "Malware payload (GuLoader)", "value": "0a351f965717fa36b2d51edc93876ce82457dff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "b072fb59-b892-48ac-ac2b-caae54203c48", "comment": "Malware payload (GuLoader)", "value": "974f8bd41dffb8927ac583e8a0ecec8bb2712572c9bbb00c74cf393e970d1a6e67b1e9e06c4ffd31a0b69a94a185d99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "9004b483-08ab-499a-8220-7cab48d89b8a", "value": "T1CF7413857640D0A7E67347324EFF12219EB6FE453BA45A4F13042F56FE32A50DB1E289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "b8727d95-547a-4bd9-bc4a-e14fd227b430", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "79210525-6315-4ba3-ae88-eefbcfff0fb9", "value": "6144:kXsKoGhhRXLqGqpHLB4d9oZmE3ePeFzjvkQNNac5YC40c0YtjMpXM24FpdVPVnSt:kX9hRXbqxaKA7P2PsqNaW34OUMpXf4FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374100, "uuid": "7e5fa9f7-87d7-4ddd-8f80-402536e9fafd", "value": 347800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374100, "uuid": "288aed80-c82e-438a-a5d5-1287ba8b75d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "5c0cc8f7-566c-4320-91a5-21aa9aa6033d", "value": "5de6bcfc6e324816d9b4c7363785e986006395b14d707ddddd3229f249f5b1a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e7f155-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "0db3860f-a31d-4f78-bb16-99471cf55124", "comment": "Malware payload", "value": "3260c425f1d0425e1fdc18cd18e5fd66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "e0bb672d-9ded-4719-a95a-222255312ad7", "comment": "Malware payload", "value": "5de9e5222b6a16dde58b9388782b7b3115fe8c8405455e1fc54dc37a2bbd99d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "5692735f-dd9c-4ffc-ad1b-c1ba28ca9458", "comment": "Malware payload", "value": "03025164b8b043b85d282cedd7a561db08ffac76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "e16d57a6-d1db-49ac-8dcd-f884a6017438", "comment": "Malware payload", "value": "7b2c17bf426dad6f00fe952cb02d81dd70d790e951d5b5b32453b272080a1c8cbcfe6810ae8dab2a23e591abf27dae87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330425, "uuid": "4cb8e2b2-b27c-4796-bc9b-bac55f37d4f3", "value": "T12B031B46EA519B09C6D272BEFB8E014E37176FA8E3ED32359E306FE013825E70935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330425, "uuid": "96d14643-f17b-406f-a713-24b47051e4dc", "value": "768:MknVZ7W0BFWJpzunYeNLDvm9pJ5M8Leio6hg+wd9SaVjHOyh:MknV9VBFWJpSY2SjDMTio6e+wdROyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330425, "uuid": "c780297b-36d2-4a8e-9a73-58acb4a238db", "value": 41128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330425, "uuid": "a37ba727-9706-4b8e-baac-a231ce03bc7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330425, "uuid": "d8e7b9a6-31c4-4d5e-a602-63060f9e1013", "value": "main.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c7bc5-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "f177e820-aad3-4efb-8ba2-6b16fd789fda", "comment": "Malware payload (AsyncRAT)", "value": "ff937dfbe6555ebce215fb444f1a9a9a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "3ac7e751-e1c2-4fc8-bd50-43565c6eef69", "comment": "Malware payload (AsyncRAT)", "value": "5e367c100af535fbbb49cab79f9d566f2f2681d01c038ec51c7ebc5ce703ae7f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "fe4f737d-a853-44b0-ab64-4d7941fac500", "comment": "Malware payload (AsyncRAT)", "value": "7668bfbf55145209c9a8b9ae770399a100186700", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "c673728a-2fc2-4b2a-96b8-22957b6754a2", "comment": "Malware payload (AsyncRAT)", "value": "938375a0b717abb8f81307539970e669655a00452782f62d9c314781c2713f2ac01f309c1344c2eb35713f0e7d776a9f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "6f0d8ce2-736b-4512-8a6e-bfd1f916919e", "value": "T134F412286216E907C95117344AA1F2B463F89EDAF503C22BBBED6EEBB533B454D401D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "ea5e8146-8f53-468d-b105-469bf962e942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "d072ec00-deb0-4359-a94d-4d314fa9a39e", "value": "12288:F+lJdbpYaD3oReS7Vb7wTgf0giyU6eAElJOzwtQRbgOzxdqoj3spyIkAj:F+HYa8ReS7Vb7Ogf0NRVistOtgIspyIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371793, "uuid": "d6e125ca-e19a-4d50-8776-63dbdab0218d", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371793, "uuid": "ea57cb6e-6ef0-45f0-b5d5-9387e8a339ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "0fefa644-c904-4025-9653-aa64e08dea54", "value": "5e367c100af535fbbb49cab79f9d566f2f2681d01c038ec51c7ebc5ce703ae7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058834f2-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "b6942d18-a406-4866-b5f4-1818523338eb", "comment": "Malware payload (AgentTesla)", "value": "f3ef9b4cf25df36beba17cc38d1e3976", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "4c7ddcf5-7c49-4bc6-b8b2-134661c5854c", "comment": "Malware payload (AgentTesla)", "value": "5e6d5e2e3318df276f5557fa7728989034c355a35ad8ef2c5266479e73d71457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "5f503fe2-7b49-450c-8bc1-9ee97a14c84e", "comment": "Malware payload (AgentTesla)", "value": "1e82fd4a9b84879a5355978aec76631c7dc3a07a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "4a816e7c-9a17-497c-9bee-5571b6835daa", "comment": "Malware payload (AgentTesla)", "value": "52cc21359214c18fcb5f73f9fda208a61739b4da9560953ccb265b17487463cc3aa027a2c10f5dd9b9a4440c414172c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "8a65dcb0-a91b-4dc5-96e0-4b5291325b30", "value": "T1213501389D8B5A60CB7D1B78C16618AC23F0C553E257DB2F3EFD91F49BA2794A817042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "6b5dff4c-02dd-407c-993d-5fede398f4e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "6770dd68-afa1-4cf5-b2cb-fd7c837393c5", "value": "24576:4gn1u2UxAPqGcv/+Duyx416HzL8Ew2GClGv:4g16qPRcvE5HzIEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371364, "uuid": "b1e43282-900f-4ff8-9add-b9bab80ff050", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371364, "uuid": "691c68d8-8ff9-4a9a-9531-b2ab37509fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "8ded6440-1002-4f88-8d1b-0fc0c21e55e8", "value": "5e6d5e2e3318df276f5557fa7728989034c355a35ad8ef2c5266479e73d71457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94404561-94a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786359148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "58bb119c-d1d0-4694-9bac-b1e5e6bafc44", "comment": "Malware payload (Efimer)", "value": "35c4db4b3d5e5476260429618c85b893", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "0c82d4f7-643c-4759-8cdb-df9b0c16d159", "comment": "Malware payload (Efimer)", "value": "5f3f2f5b15455104ffae6d588c15e3e66c6f851f698956ed2fa2494135485b92", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "c7247520-c9a2-470e-a4da-ba69ef87dcbf", "comment": "Malware payload (Efimer)", "value": "a06968a0f3b7b985761ea55d5be1aea1a93826cc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "bab38e31-9d87-4b6b-91be-6e23f23380ea", "comment": "Malware payload (Efimer)", "value": "1e00f12c8da86a704fc0aa55b336bc811d27c93a4bab5bb6844c4d0d53e5af387fe2a05d14fec79f75d6ec6180ce108e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "296cb54f-ef81-4af5-849d-47580584f05c", "value": "T1DEE6331861D002FED9B3993DED925585EA72B4379B32C9C74B5847E69E232E08C3C763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "e6396838-8d4b-4e1c-9a83-7585d0f5085f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "af9bc70c-14f1-4b18-9895-2a1aa93928fa", "value": "393216:6YGmazx0Gdxkb/qZabbMXMCHWUjQcuI3/PGTAI:JGFnxKaaPMXMb8FH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786359148, "uuid": "e9487590-ca3a-46df-88ff-230e94a8c2f1", "value": 14273697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786359148, "uuid": "b3f25228-6a99-4b87-91c1-d244f676555a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "01d8440d-592b-416b-82a9-53f298c6d43b", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fb43cc-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "44d44380-9aa3-4f31-b289-3fe80170014f", "comment": "Malware payload (AgentTesla)", "value": "0c2d59652cd96474c1c7cebe66860aff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "3b36a8b8-b363-45fc-a65f-217d83c9a8a6", "comment": "Malware payload (AgentTesla)", "value": "5f5a651b70cbc2315ca3ac61856cfab551119849e1676729f51a12e558e7d68e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "c84c8416-7999-4967-803f-f9a67e105924", "comment": "Malware payload (AgentTesla)", "value": "a2b8d375363dd0e46721facd6cf061cefe23062d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "85bb3bd0-4d58-4cf5-80bc-a6360a0ae417", "comment": "Malware payload (AgentTesla)", "value": "b7eb40dee3947db2948274a95245994720e3a1dcc839d63f152d792457b47563cf971c81db3bc2dfdfb59426353f9271", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "6cd8b114-20ca-4288-8776-d6f3b647b105", "value": "T1EF3512196A89DC15C5E207B564F0E33863F77E9CA421C21A4FECBEDB3D12B025D18B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "bc8d3fcc-c38f-4cb7-bcd9-842d99f3bc75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "76d09218-0b96-4d78-9a7f-fe42d8b34a95", "value": "12288:RcMUHYwDc8u6GLUEUJlDODtj33K5S0/cR5P+KDOHq4TOEXgc7SyTYOBRPlxyLS/F:gODR3ReHqCOs9Rtxr/vS0Lu41UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370739, "uuid": "616b0ea0-dc7f-462d-8d50-c955d4e0c536", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370739, "uuid": "92938d19-7093-4af9-8c1a-113147be2c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "483b72cc-ac8b-46f5-8e93-c439469f6777", "value": "5f5a651b70cbc2315ca3ac61856cfab551119849e1676729f51a12e558e7d68e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c47cee9-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "2e427898-12f7-4e27-8573-29f97be4faa3", "comment": "Malware payload (Mirai)", "value": "2a2175db00cd936a31e9de6d103c37dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "a1c29d28-157e-4c95-8dd3-ac12b5246cf6", "comment": "Malware payload (Mirai)", "value": "5fe771dcafd255f49fcd226534ed1eb00ebad5d120e4426217efc67a305bd7a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "b466f876-7512-40b9-bcc6-22b5d60cbc56", "comment": "Malware payload (Mirai)", "value": "fe7b6f91f7c80383431db184426c69c4dc0a89af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "e7194565-00ee-4b5e-9c60-f9446d79f6ef", "comment": "Malware payload (Mirai)", "value": "00e2bddb752cccd7fa29c4047a70f4a66ddfb2a95057166608813161f5f113feb61bb95f8d1ea1045ac0e3c8c0ae0dfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353819, "uuid": "6b5818f0-e3d8-48fd-9ee4-31a670ce6115", "value": "T123042B03771C0A83C15B6EF03AFB27F187ABE95115A66280F21FFE845332AB06559F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353819, "uuid": "cb9b51a3-5a74-4cb2-8404-9e2904865a49", "value": "3072:8jQYjLyxQactlYC6UrVO9GYjM5/GKTK6vFBv7oxXkl2CLf5QwD:8/uxQamlYFnXO/FTK6vFBv7oxXkl2CL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353819, "uuid": "c51cf38f-82d0-4bd3-9f65-8f8282a75e51", "value": 175339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353819, "uuid": "c2606538-b777-4186-b7dc-17b0b0c9dfb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353819, "uuid": "8d14b206-6fce-42b5-bbff-e19076b7cae8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaef18b6-947f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786341147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "1d082c46-41cc-4b28-a989-0ec94b449c20", "comment": "Malware payload (Efimer)", "value": "4f370e399bd2284ea493aa976696c794", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "5fb44b3a-bf38-4e7f-b1ef-02341eb700f6", "comment": "Malware payload (Efimer)", "value": "5ff2d917b5e93af56e24fa6c5e414f9679381f5b7da0c2d597d8c7536a9aff90", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "b263da9b-3ab8-4d6e-be1d-edfb65ea1e5c", "comment": "Malware payload (Efimer)", "value": "21fbe76279a10a7711b92041efd096ca25f483be", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "5d17418d-b186-4c5a-ac5c-c4a7f705a89c", "comment": "Malware payload (Efimer)", "value": "238f4192c7e4f96eed1ced00a70436878f637428e5e9ee0bd16b39114e5457e4ab9fe00ad633193b12d012197907b89a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "2f7df8f6-019c-47cd-b169-624049d24c13", "value": "T1CDE63348A5D017AEFA73A43D99D04155F4B8B86B5775C68F87A8C3902D133E0CA3EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "3e396397-6a69-4948-9632-c8c591a854ca", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "d12d0fd8-edae-46bd-8d39-a10a48282bb2", "value": "393216:zGm8QD8+Vjby3C7DjkHv7YD/MTgZcuxXMCHWUj5cuI3/PGTAI:zGSfYC7Dj6YD/TPxXMb8OH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786341147, "uuid": "c9a802ea-16c7-4515-aea6-7ce3adbc91ed", "value": 14279847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786341147, "uuid": "014c4a4a-4dd6-45ff-87b7-bf4a27a0eb0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "2c9ed4bf-5ea8-4530-b827-393c98f8af71", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148a4d5b-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "ce870080-0a8e-4da7-aa4c-fae9488d1b8f", "comment": "Malware payload (Mirai)", "value": "529427dd9a950d6233d9bb4a1c3b2e93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "44155bfe-7104-47f5-a9b2-4f5d38aeda29", "comment": "Malware payload (Mirai)", "value": "605108764fe03fc94d3d631ba09abc815cdbaacf2d4414a7aafc06934a83f163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "2294a4f6-917a-4229-bbc0-732e48ec6a86", "comment": "Malware payload (Mirai)", "value": "363baa9c661d95936d17c9d97454c331d790091f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "e0fc3be0-e364-418d-b629-e1f2e83de13e", "comment": "Malware payload (Mirai)", "value": "d9b6518c09185c92f339b42d01dd8be6a26913b271c6979013d54f77c168713d2da842c8be0bcb96ea893af5b476f1b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328869, "uuid": "699e893c-88dc-4567-8307-cf80e207b378", "value": "T1ADF2E16E70D4789EEFEC4C79420CE7216E55F0C0B28397DEEFE05AD95A35A17D44900A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328869, "uuid": "12cb421d-12af-4106-90a0-0992fcc32225", "value": "768:lGwiPffsTuFG2qcheO7GQUOLz6hPxv03XijEWM3j:1iPfiuFGANGQUX8nij6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328869, "uuid": "5678c626-0755-43cf-9252-c43924b00071", "value": 35760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328869, "uuid": "5aaa8ecc-6131-4b5c-98b0-5934c2d0c856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328869, "uuid": "816dfca1-ed83-4bab-aa33-1ff605021600", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69788421-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "5e065f79-0079-4faf-966b-781e79938e0a", "comment": "Malware payload (AgentTesla)", "value": "cea61145d549ca41d560abf4c6d4eb2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "ee153f7a-abdb-432a-8e27-55794a6ddd13", "comment": "Malware payload (AgentTesla)", "value": "6068dcaebde7c4acdc37d90fdd8b513d08c294e8608e1938c13039380f5c136f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "cb11967e-219d-41b7-a221-32534efcaf8c", "comment": "Malware payload (AgentTesla)", "value": "7cc0c7c6d1c0011ff6e51dcc849733d1940006c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "67ed6ae0-9e00-45ae-a5b8-34502fd5a823", "comment": "Malware payload (AgentTesla)", "value": "06cb7d7df75b490b99c7bd930eba354864537c22208424ffe3460d73a3bfbc9b95f004f98a672d028a3307ea818a8d52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "e19334b8-0ecb-4da7-b17a-e19babf4a1da", "value": "T1483502B25DC72A58CB380FB4C272499423F09A4B8266D76B2EFD41F49F923C95E27147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "82b3df14-58cf-439d-83ad-f17b8c1fc732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "95aa2fba-5e30-4b62-965f-188e5ec2c12f", "value": "24576:C4jxUYaVWgYfTfn/oTgPQHo0+4lW+/CiKKzyg2:C4jiYaLoTYgoI09lWvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373249, "uuid": "5c6fa58f-50c6-4677-b3a4-70fc41f6801e", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373249, "uuid": "8fdd3b48-cfa6-4ee9-a551-13f545fb95be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "582965a0-4952-4306-8d93-b7b8f175497e", "value": "6068dcaebde7c4acdc37d90fdd8b513d08c294e8608e1938c13039380f5c136f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84af902e-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "b8501c23-f7b4-4845-aac0-4c9b888986a4", "comment": "Malware payload (Formbook)", "value": "fdb3a110d4eb1003d5d7375125be03e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "9231813e-fcbc-4697-b7e3-fcc0dc83925f", "comment": "Malware payload (Formbook)", "value": "6090633f15893014c0ae325f43d048f6a2dac29e0472388f995dc42763e3ce2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "e420e233-b16e-40dd-9f00-7bffe0f040ff", "comment": "Malware payload (Formbook)", "value": "1961041009a34ecd4880f1630daee0e3f65e0838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "cdfea804-46ac-49b3-97f4-94cf47fd2fd8", "comment": "Malware payload (Formbook)", "value": "ac0a7632904230ca1e962b7aa3ef473ac9daa77692a291cd44a13a9be1d02c16db46fe728f2186bab3de8beb3db7d2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "beb2424d-a5d7-436d-b099-87ba65cc781c", "value": "T1623512186A4DDE01C4DA0B35E4A0F37953F3BE5CF421D6168FEDAE9B3A227422D08B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "7dddffdd-9187-4cf0-bb4a-34b1b33de2bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "00a3d0f6-6c0c-472b-8497-d9db62c1646c", "value": "24576:9mdZ3MWuGQaMaj1+uDbHmw30h2o7trcH2+cOPpS0bpuzn5c+bcU:AH3Mx0MCGn2opSddPpppuzn5NbcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370718, "uuid": "3c969a08-2d39-4bda-8d75-856311791c3c", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370718, "uuid": "ff3fbdab-c204-418d-8aac-b3ab3db9cb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "03fc9504-7639-43b7-bc4d-73be62f4672e", "value": "6090633f15893014c0ae325f43d048f6a2dac29e0472388f995dc42763e3ce2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730bee43-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "d0d99249-8411-47ba-9ce4-702e485461af", "comment": "Malware payload (Mirai)", "value": "f509c905a25e136cf24b7805e7e27931", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "229d5fc3-501c-4136-9a5d-6a2dcb7a3e40", "comment": "Malware payload (Mirai)", "value": "60a9db1a5e5544f5705216f79c3995f576ceff992700f915d726ad5f12df2d6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "95ef94ec-f26a-43ad-9ce7-6144cd0ac019", "comment": "Malware payload (Mirai)", "value": "c3e86dc617f5b9c56bd634e342b781fb1a300d86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "64a842fb-8f5f-449e-8376-dfbff244a8b4", "comment": "Malware payload (Mirai)", "value": "bd0e69ae29faca5ca3324356144cd1064458a46938bda504dd0698016abb1a580c614d285fe586b0b24c671559308bfe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "c51e1639-7c19-463e-8eb7-8a2cfb343e57", "value": "T1E344F80AAF610EFBE8AFDD3712E90B0125CCA54B22A47B357574D518F14E64B1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "57d9f953-c212-4f7f-9bcc-da3b237d697d", "value": "6144:snw+6e+eVEavlfEQ3XI+Sr546V6duhb1AR6Xj5N+Xk0k:iwbHcEavlfDHI+Sr5BV6dqp66Xwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356945, "uuid": "6af38401-1c6f-4f49-b5db-d36052a19de4", "value": 262484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356945, "uuid": "7bc273a9-e97a-4c8f-8c0a-6fc4ef1da352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "2cf27994-6317-4778-8223-44d3cbe0b284", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2a503a-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "3edc2de3-24be-4c67-b228-0b001b9e1ac8", "comment": "Malware payload (AgentTesla)", "value": "26e7c59d95b5b20bee49faae31238fef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "764ddd3e-d34c-42e8-bc65-f944aee15459", "comment": "Malware payload (AgentTesla)", "value": "60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "4e31e7e3-bb50-4cb0-b78b-8b5f5b03a32e", "comment": "Malware payload (AgentTesla)", "value": "459fcd8675ad1dc52c4474bca8d7efe6da15fb2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "c4a50b66-0e54-44bb-b7cf-c5517e9dd671", "comment": "Malware payload (AgentTesla)", "value": "cc2efeecbc4b5ab0c200b960a3d484f1e92cfe14ad90b0cce47240712c9a73ac846eeda34cfc21fde6c9c92e2d3c1af3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "2defce86-9e64-4cf3-b2a1-5e9c430141ec", "value": "T1D674BE93F680C6AAFC2D4C75D9A752300B72ADB696C58F4353D879123FB2280753B52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "6856d0c2-7858-44c6-88e7-6d6edbd6b825", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "717b58db-10a2-4519-bd64-01fd96544956", "value": "6144:YmGIhCrl0WKxHId8CxrM38tm0T0mAfnF5kc/JrJqoAq56zJ:fm0NxodvW38tm0HeIc/RJjAqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370360, "uuid": "502b5783-a531-47fd-8c55-9a015dfdb390", "value": 351576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370360, "uuid": "8f8c65dc-6c70-445e-a704-b65808562567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "78c7b4fb-1b46-4a64-bac3-15b11401fa32", "value": "60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fdbb82-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "a2ad0f47-2306-417d-a0ce-7141303bad6f", "comment": "Malware payload (Formbook)", "value": "84ae5a682fa191f1cb572ce2a6249891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "105a277e-47ab-420f-9d96-04df0229688e", "comment": "Malware payload (Formbook)", "value": "61b8ca3b55464f403f047dec20f0f2338a5c19564b005d505b3e60d12ad5368b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "599329f0-0de6-49b4-aad2-0593ad42b815", "comment": "Malware payload (Formbook)", "value": "65de43de02480f1697104e8c367f7c0896c4e46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "7415449d-7ed1-40a5-b781-ad0aabd0eed2", "comment": "Malware payload (Formbook)", "value": "b78937440429fb85ba3c2b51b8a9d6e3319cac4c9c907bbd831646707e2d85fa2e08e66d18098be4ae87a0f76346e978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "117260eb-cbe6-473a-978d-aab8f2f1d107", "value": "T16C3502D43B2AB704DEA86934D53AEDB852B51D34B010F9E2AEDE3B4779AD1029D0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "35cb8647-8d7d-48b8-8530-d5472129a477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "0a02d1e7-11a7-4c40-b081-9aef9977848e", "value": "24576:EDyTqGiMFig6vuvyworjNXYJjHu9I6SosvJMsR:vThiL2vyXrjNXYVwZshNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368601, "uuid": "b3ac4d32-ceae-4c9d-8704-a622ccd2b8b8", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368601, "uuid": "60619995-1b83-4b14-bf60-1e1f6a18dfb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "bcd9892a-bf88-4be3-b540-cae758c1e197", "value": "61b8ca3b55464f403f047dec20f0f2338a5c19564b005d505b3e60d12ad5368b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f0b576-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786372225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "9f89dc25-372c-4b89-8310-57786024a134", "comment": "Malware payload (RemusStealer)", "value": "23739c41ac6e6ae8a8617f7b6a3bdc7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "e9ed2716-c304-42ef-b3e0-d68af91d0735", "comment": "Malware payload (RemusStealer)", "value": "61c0328391ec425664fff03f9dc68ff85c10afcebd57f90b5aadd833a839f452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "9c93d695-62bc-4d7f-9b3d-5e6b323aef46", "comment": "Malware payload (RemusStealer)", "value": "3314f8ee0ed24757009dac65269c13a3425a57db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "c9cb0713-cde1-4954-b584-93d6f92f509e", "comment": "Malware payload (RemusStealer)", "value": "7f7b279b11369c6aaad4e50793a10c2239f732cf88326da27b3cb1087c78c5c449e2ea93361ff459eed4d933d571a22c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "906a492b-1180-4ccb-9dc9-f6a44ce32a20", "value": "T15B956B4BFCA818F6D0AAA2358C72A2517B30BC450F2123DB2E90B67D2F727E55DB4754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "859b943f-4d7a-4264-b6ac-30dc3d48ba93", "value": "9b763104e1c7e7b7334a1e9ed4235cd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "61cdf6a2-7359-4c41-8570-c8768d52e9aa", "value": "24576:SJHFHOqF+UMx9xcL1zK7o7VyzAASbyiPjKxSTy:SJHFuqAUMx9xcL1zK7oRyzDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372225, "uuid": "8f7d4b63-a9a4-442d-b515-25ece39b71e4", "value": 2047535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372225, "uuid": "8b062fcd-d31b-43d6-822c-fd7e3344388d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "46cde336-b4a0-46f8-a262-43160f96dd8e", "value": "61c0328391ec425664fff03f9dc68ff85c10afcebd57f90b5aadd833a839f452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490a247c-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "2870c7de-42b1-48f2-af2e-c3c14cc992f1", "comment": "Malware payload (AgentTesla)", "value": "e9a3c44b564ca978a79e0a5f46460867", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "bd6ccc40-de49-4cd2-99e3-7a9f7f9964a4", "comment": "Malware payload (AgentTesla)", "value": "61fe92bd8ec9b76e68bdc0d4e6a6830d19bcdbf8fc2b1f8f5ec5fe705be72915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "870eac31-88cb-453c-aa35-5c0cec07be30", "comment": "Malware payload (AgentTesla)", "value": "a784daf7af9c98924d561f77f206089ff2c3ffdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "24cb1153-3d17-4331-86c4-3cab0df9a288", "comment": "Malware payload (AgentTesla)", "value": "7664cf9d467d9b1c4bac83727e19a8b1cab8cb1c85015efb0cc72b392226be9b8b56e907d6f13061a4a82a2e70ff23a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "03a04188-cc1c-4530-a7b3-e42e9f8f6913", "value": "T1D63512446315E222C58427392AF0F77913FD5EAEB402D7538FE9ACEFB872B021D44692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "746337a3-3cda-47d1-89ae-59bb6a27ecf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "5a034655-36a1-4540-9b07-cfd86cb2a033", "value": "24576:aV/hhiEC5Qni7GeXdT2K6ke/UtsaKQAiR/5q7B6ufgPZ:YiJ7Gep2Kw/UuaKQAi/y6ufg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371477, "uuid": "a8a61a39-518b-4a2a-bb8d-dfb5bd3a1420", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371477, "uuid": "5425b260-edf9-4b9d-9565-4512e6095586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "2fae8ba3-aaa4-4fea-9b43-a4a5406a3020", "value": "61fe92bd8ec9b76e68bdc0d4e6a6830d19bcdbf8fc2b1f8f5ec5fe705be72915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe6865a-9473-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786336102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "3ec63326-69c9-440b-a4c7-a5983246e138", "comment": "Malware payload", "value": "2c20efb20fdc478615c8ecde9ff16258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "d2cea5e6-0e6d-40ad-8025-ee0c28baa38c", "comment": "Malware payload", "value": "620d0e9ce67dc78101a7f84aae27e3ddb1054c7a88d216242bb23e1eab6110a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "97df52e8-7efa-4755-bef1-e11e13bbc518", "comment": "Malware payload", "value": "69ee463eaf33122c7f5182d8acf6f13c85814a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "7fa0f49d-53d2-467d-ad86-8d200a5002cf", "comment": "Malware payload", "value": "98ca6112a76486f8f89d49d66710790afa6bc9ee841a154833da040fbf3a594def6bf249428fe58e44028d35598d809e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336102, "uuid": "b5faa49f-c3b4-4155-9914-c898ebba109a", "value": "T14223C31BBAA3B47CC24BD0B46A9AD5F1B93178B402213D3FA3C5FA312D35D512A54E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336102, "uuid": "4408e6a6-1490-4283-84ac-f73be3df0672", "value": "768:h6Q8n9I+h+ZqquVAy5pY38uCfGbGxgXw3wTXlljpPJ:kQ8n9ICpAy368QGxgXw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786336102, "uuid": "c04c4a4e-62a3-4e74-bb4e-b29bee2465bf", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786336102, "uuid": "4c16d3ae-de4c-4b30-9db5-030ec22cb645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336102, "uuid": "6aa57088-52af-4cd2-b905-a068e8e680fe", "value": "620d0e9ce67dc78101a7f84aae27e3ddb1054c7a88d216242bb23e1eab6110a2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e65cd76-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "2581b478-cd38-414f-888e-78216e776d36", "comment": "Malware payload (AgentTesla)", "value": "6a753d53eebace9181283bad8a6d02e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "ce2d3b27-7ec1-472b-a724-18721ae98063", "comment": "Malware payload (AgentTesla)", "value": "621242d555173821bb991562ad5292cc0ede93fbbe860fbb7fd1208ecf4a0ece", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "867c4e8a-a68f-41db-bba5-c1c5019a4c36", "comment": "Malware payload (AgentTesla)", "value": "e821b347fea0ea7eccdff896aac9412148b79e16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "348ad17f-8b77-4713-b951-126bda34c235", "comment": "Malware payload (AgentTesla)", "value": "e4a7164e4a8576aa776fc8bded26def5ec5c80de05556efb6600449ede79840bffe883931ae3eda4cee8cbf2a44f1517", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "f823c32f-00a9-4f46-a2e5-738256a03705", "value": "T1FE3501259DC72E55C73D0F7CC3A204A423F0C4074265DBAA3EFCC6F95EE2A8A6927552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "a71185fb-57b9-4d1b-b8c9-f59810c1b656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "cdfc65f3-a721-4d85-8991-6fc0201575c9", "value": "24576:sxd8QHXHUh0ONLjroY0GSa56HzLyEw2GClGSL:s7rH/O9HnSPHzuEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371969, "uuid": "42b2ccbb-7f8c-43bc-9cdf-e332f8d488be", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371969, "uuid": "a69007db-0d49-4184-bb28-0e1f2dda7764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "9f82464d-a2eb-42e9-8f5a-4b402e330e9b", "value": "621242d555173821bb991562ad5292cc0ede93fbbe860fbb7fd1208ecf4a0ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fe01a1-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "f8738ac6-d5a2-400a-ab13-ddd2596012dc", "comment": "Malware payload (Formbook)", "value": "ebe931a98bb6edeff27bd1d7ea96026c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "b69f35bc-b417-4c91-8173-dc43a4761f56", "comment": "Malware payload (Formbook)", "value": "6239a0af058f1d51a3fb2b85f8bd84a9ff60e97dfae1f9f54311e009a612545f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "164f43f3-83ff-4111-9f44-3d8e067cf734", "comment": "Malware payload (Formbook)", "value": "90262db570b97268cd562cce63a6032db523a0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "524231af-0698-4188-9721-772a47efa744", "comment": "Malware payload (Formbook)", "value": "298086b2374be8bca27dc999eda179ac11346b6d830e01c4db91a2c8d73f6428054b424d65b4a29ce49155de19887e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "46b28705-39a9-498e-b7ea-a16815d33c40", "value": "T1663501292659CE03C4B70BF45832D2F49B786E98E912D20B9FD93EDFB9353825604793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "9989203c-7d7f-4ea0-bc09-27480cc5689a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "25d5490a-9b12-46e3-9ac7-1e8ed1f59b0a", "value": "24576:La6UwB+UQ0N7h6EYLUsaYSBu0Ae1nKTdMAIAx3gdo8ME:La69BXwEYIov52nixy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369022, "uuid": "b92b4c92-966c-4d02-8190-010c994fad03", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369022, "uuid": "c66071ed-0f57-4380-9475-a1c9b3a15696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "1eb87e3c-ac3d-49cb-957f-87689a09eb56", "value": "6239a0af058f1d51a3fb2b85f8bd84a9ff60e97dfae1f9f54311e009a612545f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bd90e7-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "4de6c22e-7d22-460c-9198-ca3972dbd0cd", "comment": "Malware payload (AsyncRAT)", "value": "f27530384b8f4bf044541ab70b1cd483", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "cd522553-90a2-49a4-abe2-e7fa8d9ef5fe", "comment": "Malware payload (AsyncRAT)", "value": "623ee76c1d4afb67dffc3680332759a338ca7a171e3d979a01fe0a48bf3034a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "929a69f4-f75b-424c-9fce-721c952977d4", "comment": "Malware payload (AsyncRAT)", "value": "8b0e925ae72d5615856787cbf7affebbb8e67d78", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "865ff5a1-ed1e-4959-8ba8-f8819006a748", "comment": "Malware payload (AsyncRAT)", "value": "4bd1b5c2f1d2d0fadd92b3405d2ecdab2bb2755fe9f6c655a1c079ba38c61e6353fd425e017536f287b5f302f59e7f0e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "e8d951bc-30dd-4605-94e3-fdb5f139ae60", "value": "T1BDF412245669EA13C8502B791F60F3B423BD6DEAF811D72AAFD9BCDF7C36A044910153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "751b7017-f2e1-4eca-9ea6-f1fe54df89e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "0b585c74-4e9c-4807-9539-fd171e859660", "value": "12288:JTBy1lJdbbypwnbZw1yvXxB1dhWuDxOWulsMoEWV5XVkdt17uiu9najfSL7yy:JTB6pyMlX/1ds2kZ0XVkdt0iYn17y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371570, "uuid": "8d2b9704-1d5e-4bd2-80b1-57ce92e433b1", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371570, "uuid": "c2ba6229-8092-4e0f-a96c-c871c4423263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "8c8adb72-0dd3-4ef6-aa5d-2fd5bc2992e8", "value": "623ee76c1d4afb67dffc3680332759a338ca7a171e3d979a01fe0a48bf3034a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32914610-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786373587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "a0bf6ad2-8fa6-488a-add6-f649a13f67a3", "comment": "Malware payload (njrat)", "value": "d0fdf5df46f7627820082c8ff8da70fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "c6163049-3242-4939-9e29-b08bf5aac2d3", "comment": "Malware payload (njrat)", "value": "626c7070556088e0c2b6d473707d7763716d49472e0378b4a1682732f917893d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "1c6ad65f-bafc-40f9-acb2-0879f16aaa71", "comment": "Malware payload (njrat)", "value": "6d16dcb0186ef1c562c824da4e43ab41ff3d414f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "46065dcc-1b2e-4af2-bb83-5a7211cc44c8", "comment": "Malware payload (njrat)", "value": "fbfdae5afc1ebcc20c57f9a96d50f3011269d1dbdc5c1eec74e64ccbbdd5a0e18fe6e1acc168360c6ac697e378132643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "e06468a9-37c7-4a74-bd25-629a16ee26b8", "value": "T1FC15F1191A278602E9B1AFF01E71F0B0577A6CEAA535D60A4FDA0CEBB0777507C1532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "271fed99-1673-40b5-8542-9dc6d92d51cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "dfd08f6b-8091-4794-94dc-e09fab8ad93d", "value": "24576:UQYJTnEq5VYx9MUiSlCwJcTp/XJ2FfLRs:UQY+qWiQhZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373587, "uuid": "bdc69559-6e47-4b8b-8d2c-61a2bff4848c", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373587, "uuid": "367ae246-3cf2-493c-aedc-ebc2e6d02219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "b975a6fe-e41b-42f2-8ae1-7469c1134ef6", "value": "626c7070556088e0c2b6d473707d7763716d49472e0378b4a1682732f917893d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5788fdcd-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "a143091d-0f2f-45e4-a21b-6d39781f0f90", "comment": "Malware payload (AgentTesla)", "value": "a815abf64b56e6f733e22b42db19e853", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "43e60661-f4a2-47ac-bbf8-1a6ca25fe04d", "comment": "Malware payload (AgentTesla)", "value": "629fb8f53a18bd7ce5d16d3bb22f97e41d21301b25d58a7e505f8fc1ca55c907", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "667bc6cd-42d2-412e-a6cc-dd521668fce4", "comment": "Malware payload (AgentTesla)", "value": "2530b59494d5abf6a517c0594661783fda739c43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "60af439f-dfc8-4881-8758-17acf7494e9a", "comment": "Malware payload (AgentTesla)", "value": "ca741cf8e829debed94e7dfe353f77d04b0256f96064f11a93d79402d7dff87bdd72947986f01aa89075e5cfc58e1ff4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "78d294e7-0348-46ba-803f-dbd7e3e2a597", "value": "T18B25012815278A03E8B26FB04D31F1B16B796DEAF631D20A4FEA1CEB74677107D04766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "99a17782-c03c-4d74-bf53-147159a6d299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "0179e80e-73bb-4508-82ed-743cffbb73dd", "value": "24576:Jnz/kr1o30Jd4XKLTM9s0GucLla4SVfn6jc:Jnz/G1K0JdC7s0bcxazZnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373649, "uuid": "dede1bd3-0fa0-4f18-ab7d-33fb63e0fc5f", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373649, "uuid": "0a9eab23-c688-4d56-a006-2f6c5e6736b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "dabae7fa-5ae2-48d9-bd2d-d995af07d733", "value": "629fb8f53a18bd7ce5d16d3bb22f97e41d21301b25d58a7e505f8fc1ca55c907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a62530d-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "0cb7fdec-dd86-4bd3-958b-f2d412a48969", "comment": "Malware payload (Mirai)", "value": "db10ae26b4119d92c4334cb6c75849db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "929dad9e-badd-469c-9abe-923bdf0ddd97", "comment": "Malware payload (Mirai)", "value": "62cbf1bd12fc71ba0423cc93d3486237ea84268ee702b54d160c9bb047b4d97e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "e62dade4-ddc9-4d4c-8ed7-0748ea25f21f", "comment": "Malware payload (Mirai)", "value": "3fbb69b2211da9f5a886a061f55664f67a388079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "b126cb78-185d-473f-ada2-3f694068a42b", "comment": "Malware payload (Mirai)", "value": "820f047c728e0f969ec8f83428d9f239515acc9f4310ceafb3fdea93e38fcce6729c10242b42475bbf9399994749134c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340207, "uuid": "2ee845ac-3c29-4f2b-85ce-0ad423fda603", "value": "T15074FB88B5F2E2CAD1D4EAB5E319784D3B630736B1D73145A50EEA3312EF15809BDE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340207, "uuid": "60c061fe-0b3b-42f6-9094-7076de5d0b94", "value": "6144:8a9ya95a9SjkyWqsMYhsrwfjJjckH/dnuVOVPQYC+bjTTiztp:8a9ya95a9SjkDBjJ4klKOpc+bjTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340207, "uuid": "9135da75-bf13-4a51-bc8a-fd7868efe098", "value": 360944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340207, "uuid": "5512a180-ceef-4d89-bab6-3def17795276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340207, "uuid": "abb9eeb6-06f4-4ad3-bc28-4bed1013f5aa", "value": "pid.ar7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f718d28-94f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786392587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "9572ca4d-080d-4d7c-bd01-1d0983fb1ea0", "comment": "Malware payload", "value": "e6419b2c12c29b75847a945ed1104b2d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "45892781-2aa2-4b31-970f-6cd5255241b1", "comment": "Malware payload", "value": "62e99fe42356690d0d6f03e331b13f213b07d1e450e6ee9526d0bc0500905bd6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "937f2b64-115a-41d9-95e4-42e74249f47e", "comment": "Malware payload", "value": "1c478433bb36f720751321d86f91234f42eec13d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "9917ef2d-45db-43f1-8765-d056b88f8b79", "comment": "Malware payload", "value": "bd3ef52b48e845639c1620b513c894d67fc344eff7f5277cbee838b1d3f4dadf1f11ba8872a84da18f5e5d0298cbafb4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392587, "uuid": "a4ebbe2e-18be-48e8-9aa9-7fceecca25ab", "value": "T18B01CECDD130951050AAE86C32DB6064F821C3C7194B4F76BFACA47E9BDCE04B026FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392587, "uuid": "87f1d550-0b46-45f6-abcf-df6731891592", "value": "24:kXCKysE2hi0ziQvZohauXIvEqbTflB1zeX:e9Qp+MsmIvEGTj1zeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392587, "uuid": "12588c37-382a-4cdb-89dd-3037db223b75", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392587, "uuid": "22996c32-49b7-46ac-9382-0fa41322020b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392587, "uuid": "7997b531-b551-4275-b83a-19d660d8d138", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13144b06-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786328866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "a866ab40-ef52-404a-b799-aa1ef2df4eb3", "comment": "Malware payload", "value": "3d62a8a38ae1d5023c0f7647784a1df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "67bf106e-9f17-4d41-9c19-893e9633a627", "comment": "Malware payload", "value": "62f058d6f04af72a0dca6cb973fb9b7b6b75aa6162d769abf9bca946fcaedeb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "acc553e9-9821-41a6-9a6c-5f83c6febb7a", "comment": "Malware payload", "value": "87075f7aedda63b6d6974ecb14cf8536688ff208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "9fd1bd0d-8335-428f-af3a-037515ec0976", "comment": "Malware payload", "value": "bf40410fc15bcd8eea5e4384cb7ec25550414598e0a7aac3072247675eda3321d4cbda0f85235f4d3de15ec461447fd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328866, "uuid": "8764f3c2-07d9-48ec-bb5c-c8667206a8ce", "value": "T135133BBEDF0E3941E3D4E338EB550BE1603F7924D39680B67E42718DC4E99DD89A2246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328866, "uuid": "9faa634d-6a07-46dd-a9d9-617f03bb9ff7", "value": "768:QVE3rvrM5WPmE9CTjPavELfT/MVir4FyGZFLawW0KrT3C2hiWW:WEbzM5ZRPP7YYs3ZEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328866, "uuid": "ed6ff084-1bac-4d51-a4e4-69975592520b", "value": 42048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328866, "uuid": "e973ee0c-e72e-4579-9282-30f2cba6a11b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328866, "uuid": "79b22199-d0c1-4096-87b7-4aa9ae138719", "value": "main.aarch64be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8c4fed-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "61fa2321-1213-45e1-a2cd-7c32ab38b79c", "comment": "Malware payload (Mirai)", "value": "4c30f86beeed0e46c6d6d398973d2ef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "18d748a3-c2cc-4ddd-af64-f3c8e5e3a1ab", "comment": "Malware payload (Mirai)", "value": "62fb0f9252f8009b02e0bb658210beb9b01c6fe4c0a07ad3f06244a0f6190c42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "614d3151-50cc-419b-88cb-0a9424ee57c1", "comment": "Malware payload (Mirai)", "value": "20856af30673eb39538326309e09f17085a6f30a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "b8552624-fcad-4535-a8af-4180847065a8", "comment": "Malware payload (Mirai)", "value": "0b066917d45f976564ffdb38b17ac097b21ead033ed85cf71446213af7526d410cbc19a30f52b6639b2d78d6e4e1bf58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353816, "uuid": "527df952-209f-4be8-b0c5-b9c05da83938", "value": "T11D34A71A3A12EFBFF568863107F38A7097D521963AE19346F26CD71C1E2028D685F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353816, "uuid": "c6db8fde-6e2c-4c4a-9238-8a8a47424da7", "value": "6144:sx7f5flfnJXQhAoNlaDm7zvnreG3Ai/a9vNYzpWe:ubfnJSgDizvnreG3Ai/a9vNYzpWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353816, "uuid": "677149f9-3c4e-49cd-b714-c1972244c2bf", "value": 238353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353816, "uuid": "c0b6e511-20c4-45f4-9c85-47f770c68c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353816, "uuid": "0535be1b-486e-482d-96ea-ecaaf4c0d51e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970fb65d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "f1e2ee83-5c53-47c2-a603-163142b470a6", "comment": "Malware payload (DarkCloud)", "value": "6aa4e8829156aa52686ba3804b533738", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "59b47105-87f1-46ef-8db8-59b832a26914", "comment": "Malware payload (DarkCloud)", "value": "63363200a03e8ef1c2790eed53def864d750d6adf08779186770507473b7a1a0", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "a4e035e2-bac8-453c-ac82-6c0f520f71ce", "comment": "Malware payload (DarkCloud)", "value": "e312d46625f527fa03deceaa5e16e0cbf0c7dadc", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "605a4ed5-2c83-4a5e-9ca9-d2956bed2b29", "comment": "Malware payload (DarkCloud)", "value": "d72e821cf9d223be087d261687eac0a91aa115fd527f2c0d6dc3a55af7e52abfb216f9954a18ee22ef0b221eeb189aee", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "ecd490e1-27b2-4dc0-bde1-b746ea9a9dd3", "value": "T19D45236AC156C013D18907FE6E62C0B123B92ECC2511FA5BDBECBC8BBC6175B6914B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "40f372a1-c888-47df-96de-1e917055123f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "86dc9373-e7e4-4abe-9f40-901facf559d1", "value": "24576:Z3HBYg+gnzPjsNFBMyax3jruRRBXZUeVS8LxpMW3Xk4Xn+JTDfcHBY1HBY:JaLEYPB+3mRRB1VS8LxpR31X+pDwaRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373326, "uuid": "b40ad61b-69a7-4352-b240-df4bf2408d74", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373326, "uuid": "73071058-0ed2-44c8-b891-4a31d9faa171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "70a80550-6208-4c4f-a8ca-447d00589577", "value": "63363200a03e8ef1c2790eed53def864d750d6adf08779186770507473b7a1a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0812eb67-94dc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786380817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "abb3d343-005b-4cc8-b0f6-25ec0ca0d7e3", "comment": "Malware payload", "value": "9a3aabe8657b2f87da866fa6ac24746e", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "800e597a-f315-45fb-bc6d-079efa85887c", "comment": "Malware payload", "value": "639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "cb1b000e-0ee3-4eb7-adb5-213e11815ab0", "comment": "Malware payload", "value": "c8af31d99e4f1905af7ede0840ed50abe762b807", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "f318faab-ee80-41ee-a784-f71053d7b367", "comment": "Malware payload", "value": "5b620fbdff9a1947f924168d6715afb5cb2ce71686dfe5ee2e1adb7ace0f2f991dca6947ba444a071cfa843a635d3f56", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380817, "uuid": "afe036c0-db35-4c77-b955-6c9e8d2dd167", "value": "T17397334860F96E18C15FB372CE533B5D6BFF1666A83BDE42FAE3A18F42151C9821508D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380817, "uuid": "6058500f-9d85-4a10-a624-f91a055f89a2", "value": "786432:0l0ZmMQuvvHHb6daRumWzPJ0pIx/7ak1PHftafaemq6zK1:w04JyHHSmWbJNBIj16za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786380817, "uuid": "eb5aaf7d-4755-40da-b1d7-cb927e49acf0", "value": 39605378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786380817, "uuid": "0cdd98cf-224d-4c50-861c-32fa6b38f44b", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380817, "uuid": "d477418a-3e58-4e9f-9532-edc39dc32dac", "value": "Zoomupdateinstaller.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a938f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "1dbdcb18-e98b-42e0-8a41-f413aa5ae580", "comment": "Malware payload (AgentTesla)", "value": "d0729d1aee5476642dad75160a34e6d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "23e1673c-0f5b-4405-bc46-d6178bc7a972", "comment": "Malware payload (AgentTesla)", "value": "63aa8d418861ddd8922cc8bd25e808ef7b251f35f2605cfd64ba0d2efdb6b0dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "bc214c26-b268-4ef2-b467-aac212706fd2", "comment": "Malware payload (AgentTesla)", "value": "d43bb103e8669d5ea34461c87df64264d357e416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "034293f7-ee40-4fc2-8b83-e6c9b34134b5", "comment": "Malware payload (AgentTesla)", "value": "b1677a32173ba343e1467141d6afd7505f71eaca02667b50f73112a37c9e997357f4a9557bf7e476c63368baa965ed1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "2e26cc72-400c-430d-88fb-140a9994fdb6", "value": "T11D3512714C472659CF3E0FB8C1220A5823F0DA1753B6DBAB2EFD50B95B832C59D2B685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "66f53f20-f24d-4e10-af89-9514253a445a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "84e1c90b-4d31-4e0a-a0ef-aacf4e0a4f48", "value": "24576:rqCSTYaVWgYfTfn/oTgPQHo0+4lW+/AwyOjMG9bN5Y:rqCSTYaLoTYgoI09lWXwyONdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373231, "uuid": "e5bcc5d4-18a1-4b5a-95e6-924d9c6cefd5", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373231, "uuid": "f05346dc-1730-4a3e-a629-a66dba52b035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "a1dc3c2b-fa3a-4939-9cf4-b880f5345944", "value": "63aa8d418861ddd8922cc8bd25e808ef7b251f35f2605cfd64ba0d2efdb6b0dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73145945-945f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786327309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "cdb58ab3-acf6-4319-bb32-3fdb5f8484f5", "comment": "Malware payload (Mirai)", "value": "03429a781f706020cc1897d2ce9d17b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "b881e8ff-dc9f-42c3-a7a9-f464604ee6e0", "comment": "Malware payload (Mirai)", "value": "63c7c59b2959a3de5a5456dc53aaa41362bb7a610e8a872f15dc2b5d163902a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "ddc45abf-310d-470e-826a-9fbe39e4f5b8", "comment": "Malware payload (Mirai)", "value": "97e0e91f907ad4d7eb1756756d348184caab0710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "36d26ec6-88ea-40ff-85a7-eefc26173552", "comment": "Malware payload (Mirai)", "value": "8288c43492ddc1568914da1d94e8e6acd74b41b253271fb4639a7e96ab06c994aa0581ab1fa4bf862456f15d3ca90577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327309, "uuid": "75e26bf5-80ca-4a23-85e7-7168199ff237", "value": "T16B731A5AB8819B11D5C116BEFA1E518E3313077CE3DE73229E24AF20778796B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327309, "uuid": "9eddf0d2-2dfc-4770-b55a-b4aef827b5e6", "value": "1536:SDnd7oMCDO+qrwFLtdoaTv8LQ3Mxi/1eoxZ61AJ7NG5FYNz:27hCDBDtdoaTN1eoxZ61AJxGnuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327309, "uuid": "80a0f8d7-4084-42ea-938a-2b8953fb327d", "value": 75348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327309, "uuid": "e01c534e-f420-436d-9b85-ecb8c125b8d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327309, "uuid": "76a629cb-6805-4918-bcfe-5b17644ec44d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a448fe5a-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "20e82924-e057-44cf-8e8a-138288d04022", "comment": "Malware payload (Formbook)", "value": "5cf9be7dbed2c44e4d32d56ed880eaf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "419e32da-c1fb-4449-a55f-46ab457a149f", "comment": "Malware payload (Formbook)", "value": "64416ba83eea79f37407e6af107cf4b5b40b0a2994910e37e60a556b0b156476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "3fc78d26-efa6-4a08-a808-2a928355ce83", "comment": "Malware payload (Formbook)", "value": "8ee0eae42a3de2f34753136214542b3d75fcf6b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "b5542632-f9ac-48fc-814d-24d41767aebc", "comment": "Malware payload (Formbook)", "value": "57634e23bbfc11277913aecb03c80f20bc456665b545d894f6f976cb66de8877bdebc58b75e5c1cb468f13332be57389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "ea88502a-cd31-485d-a240-16c6c9777789", "value": "T1EA252314DA96EE29C39507B40AF5F23E13B42D5ED522C367CECADCDB7099B4420987B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "6cf7c5ab-8d71-4cfa-b18a-d69035dfe4fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "242b465e-1132-4e5e-b89f-0051592246f7", "value": "24576:Ej/Og3m8p4va8BdK0zmvT0jlHXGrAQT6iGtP2Nx37UsuGUH16+:+Pvp4va8GVvTwl3GrXPGtP2N9Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372060, "uuid": "aec60b62-3be9-4b2e-8139-a5dcf9af933a", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372060, "uuid": "5a494f2a-fac4-4986-920d-66e7e292e8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "1d186831-39bb-4e13-9375-f4b9aad719f7", "value": "64416ba83eea79f37407e6af107cf4b5b40b0a2994910e37e60a556b0b156476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14a6378-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "32a8417c-ede2-4796-b937-9b1eac6c0b7e", "comment": "Malware payload (Vidar)", "value": "4fe7875b4226cbe87dff3d5fa52e689f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "6f69324c-a3f0-4f90-a8da-4d26a47b8170", "comment": "Malware payload (Vidar)", "value": "649d23fa6cea42e2fd41cde64c765db038abbe9323c53fc33a1067a6f3895f88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "e4dd24d4-0fe5-4ec7-8a0c-80bb37facbd1", "comment": "Malware payload (Vidar)", "value": "1fa128a9cc51f2b810c492651b66fdabe3457bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "71c024bd-b278-43e9-9b50-94bb347fe1d6", "comment": "Malware payload (Vidar)", "value": "7b8225bd759482b172a4aea158883da7658347849e5f5745d3e20fd14a7200d0f6d6943a6149918a39ca020d88f363d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "51e8a068-7094-4ff3-9d3f-0715245c23a2", "value": "T1F052E789B28770F5C0AAC37CDBC7167A8A627084032D9EFF9BDDC1C829D251139B45A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "8c7532cf-fc5d-4443-a915-017b963fc16f", "value": "0c46c7fafa1efaedd2bd2c7fa5773426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "f828b4b2-9a12-4f29-9c4b-9cbb6566f355", "value": "192:OYOoSJNAkin7nNIzzJu2gvxIgb7kmOstrnQnyh7s0wB13TyU3VR26zatsDW:OY/SPin7n8YxIgbImxpkZ3TrlZzysD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368189, "uuid": "88921dcf-e2d2-4cdd-a58f-689714bd5923", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368189, "uuid": "c6fe2dc4-241f-4ce7-94de-da1fe4f2cf9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "6bb4d8d5-5df2-4a82-9264-98dcaa6b6d97", "value": "649d23fa6cea42e2fd41cde64c765db038abbe9323c53fc33a1067a6f3895f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc4d296-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "e2241a8f-4f2c-455f-bbe4-450d9edac4fa", "comment": "Malware payload (Formbook)", "value": "f978f659e30cf9215d5c70184a72f791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "5be0972e-fa10-4541-9746-3d3d3d14ad4f", "comment": "Malware payload (Formbook)", "value": "64ef4bfe4937ea47d418c2a0797b324bb0beba076700bfc5ec6274c8b9e757a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "1c92407c-defd-4bd4-8238-21ee7c29a29f", "comment": "Malware payload (Formbook)", "value": "0fabbdd4fb8663fc57d34bdfbaa98a2caa739204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "ed5722e2-ae90-48c1-9852-6854474ac110", "comment": "Malware payload (Formbook)", "value": "1093955b8420e82dc4fbff7d430b47a59b905f09a1a8a5218424767afe7098dc68ddb0df56a24c56b160c6ebfdd7bb62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "302c612f-3ccb-4ae2-abd4-3afd90b6c1e5", "value": "T11B45CFAC7211B9DEC457C97289649C34A6116C6A830BD203A09B3DEFBA3D697DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "c128f92a-1b29-4ba7-826b-15a59b2b631f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "94b0db41-5fd4-4137-80e8-095b6a79f141", "value": "24576:pjvj/Og3lUt2B9gjk3YIvtBWMgEk9XupQYjUsADpERTRSfs:F7PmgB9gkBtlC9X5RDuRVSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372423, "uuid": "2ec0186c-eab1-446b-89fb-abac9cf6efe2", "value": 1252352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372423, "uuid": "edcd02ee-7b67-43b9-a8f1-bc02720a51fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "1f9f5cc5-ee81-44a1-a9f9-112872c2d841", "value": "64ef4bfe4937ea47d418c2a0797b324bb0beba076700bfc5ec6274c8b9e757a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc8eca-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1786373713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "b4605d94-ab93-4cfe-83ab-d24c712af9a6", "comment": "Malware payload (DonutLoader)", "value": "4f5443d85b42b62f03fc6a7655a398af", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "4e061709-a52e-4f08-a93f-740d20ee8d22", "comment": "Malware payload (DonutLoader)", "value": "6521394d5adbc47d59c42a22199a9ffc9b4192a3d2eea10c716829255efd7ef9", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "9c75e0b1-8167-4e47-816b-848e2d479685", "comment": "Malware payload (DonutLoader)", "value": "5be0a231ed0c7739eda4c7b2340ad5a08e9bcf6d", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "0a0f06c2-1803-4faf-9990-09144a42a3d6", "comment": "Malware payload (DonutLoader)", "value": "465a1ec7c3cff3674f41a8be2160455c1ca01850039619f4ff3746b6f2778da165cae29fca6104ad16e9e9ccf0334f02", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "0d601588-7198-48ac-a3b1-a37afe4c9b36", "value": "T125A423218F581EFAC6F5C67719BE4E8563323E25B0D8D0EE029E111B01F6E513C6EEA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "4dcbaf61-eeef-4ebe-a515-37988c02f402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "3a9cf78a-afff-4440-beb6-444304b7f8f8", "value": "12288:RW5sSNQXHgTwRPqGNPWrMDdR+XGkpx7GqMHLa:RW5sSNKATsjWr8X+XXY9HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373713, "uuid": "af15f538-53c4-4e33-b024-ff22e7f0bdb5", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373713, "uuid": "49520bfd-4719-494b-a225-4c402b87d0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "cdc1dc4b-1e8a-49d6-b415-67bd5d96d546", "value": "6521394d5adbc47d59c42a22199a9ffc9b4192a3d2eea10c716829255efd7ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d9338c-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "e7f91417-d23f-4ed9-b69f-9b8676c0226b", "comment": "Malware payload (GuLoader)", "value": "851beb1657e7ad7797d8d90c07b449ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "a304dfa1-c401-4c33-a7e5-3f459c3dea8e", "comment": "Malware payload (GuLoader)", "value": "6522a9aa201edfd5449037d4576bab69c83abeeb2a3a73f06e91682c50051dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "b4195b3a-866e-4ea4-b46d-6229be1fb92d", "comment": "Malware payload (GuLoader)", "value": "0c9b38929895d235395dc9f0846ef40e2def4fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "57fae9cd-6057-4cf0-986e-43fdeef17f5d", "comment": "Malware payload (GuLoader)", "value": "9d6829283a44dc038dee72c44794b553039a2b6b73e42d72d98c00cdeb61e3921ee0e3d17f8d6e6fcf52cd691227cfe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "fd3311b1-da12-4b3c-bae1-07cdf5c12299", "value": "T182C4E0C5BD109076C4AC0732E06EA66F196BFF2D46345A4322ACFF1B7A7D702851993E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "c4fa9917-eb1d-41fe-9ed5-021fede88de1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "5888beea-2926-42f2-b61e-9a020e798524", "value": "12288:JXctpOFtZmB+2ufn/JmaKQ4ngNNvHEqho:JXYUFvN2qRm9WE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373129, "uuid": "d3e28d5c-7ffa-4268-8cb2-41237caeb4ef", "value": 583704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373129, "uuid": "4fce5d00-86df-4073-b149-b1007d9ad6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "14595356-0b5f-4b70-a071-2c36db13a890", "value": "6522a9aa201edfd5449037d4576bab69c83abeeb2a3a73f06e91682c50051dc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f639a3b-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "6e15e2a1-d5dc-4d0f-b405-b9cb9f088019", "comment": "Malware payload (Mirai)", "value": "6857952d8149484cc0e9860f8d72b266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "6fa05dd2-6933-4833-a110-eda0f93c1599", "comment": "Malware payload (Mirai)", "value": "65a0fa3217889f845c9700d8e4f9faf212a32299c19183446243a7790c330d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "e146f195-70e8-412d-9502-be1917d8e969", "comment": "Malware payload (Mirai)", "value": "71d0275c71ea95838b3c70d14b4a653cca8f9016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "83945659-391e-4563-aa9a-7e449681bfb6", "comment": "Malware payload (Mirai)", "value": "c1d119bb3ceaefbca8269d5d04998ec86dd5ab13b355550845dfa1310616f0df5c5f2e29add06e3f470a93be52e426fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340054, "uuid": "564d6c8b-ed6e-4dff-a85c-250e78236584", "value": "T14974FA8451F1E6DAD15CBD726332BF1A2F77093670D33145A09AE6BF32AF18449AC9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340054, "uuid": "f1254f7d-381d-4c57-a44f-0d253627c31f", "value": "6144:VOLaT9J/MTI1HiBRLKrbAGBeOg+6c6//h8OQJWLJWfFGUf5mS:VOLaT9YaQGkeU/KzJWLJWfFn5mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340054, "uuid": "934f7fb8-b94b-4e10-966f-d9d0d098d4a9", "value": 362252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340054, "uuid": "a7c849c6-0de6-4560-9fdd-5cd35075ff24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340054, "uuid": "0cd74e88-8100-47ff-ab6c-272ea69becc1", "value": "pid.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6722bd8a-94d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786375822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "8dd2e1f5-0010-4316-9b8f-a942a48bd9e5", "comment": "Malware payload (Formbook)", "value": "b168b4d24d692c1b8e7567f446dceea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "ff9fb92c-c8ec-4beb-8f8f-fdb301f9564b", "comment": "Malware payload (Formbook)", "value": "65dbe21962f1ecd850b8b0cabcc0f1a420d92dbf006ba94fdeda3e07472230bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "7e301d3f-cc5e-4627-af01-820185a0efd0", "comment": "Malware payload (Formbook)", "value": "64ad04d7edc49ae3edcdebbdba8792dedd1ae6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "83d0494c-3b24-4be0-8cf1-21e6cafaa2dd", "comment": "Malware payload (Formbook)", "value": "3850df5ef50d2337bba49481e96471571831887dbc8dd9a647edff1728718db4d8a5e756311514c2aa775ad4819744b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "995a4051-06c0-41c1-99f0-1ae1f9142c46", "value": "T1CBE4AFB976142CE6E67F577BCD97ADD803B636228AC799CD40A4B7C30D63361EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "ab60e9d4-4aab-4e52-9688-9f8f39b1a42e", "value": "2d3437c41fae09bc2c594d490e658972", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "6c96e50b-306d-40d5-be2b-1b16aecf6725", "value": "12288:Zh8cX7I7j2arXmBU2EyGXj56tEWB/ZTcRFN4kO269NVZhBZafkp2sK:Z/0Oc2S29GXj56tzBZT4FY2eVZT08BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786375822, "uuid": "1a76b90c-5449-48b9-8524-1bd20831c3b7", "value": 709554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786375822, "uuid": "b6dcad78-e1b0-4d96-b0a4-628d898724f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "021317cd-9c2e-498e-a0e5-0461bbf70a36", "value": "SecuriteInfo.com.Variant.Yogi.44771.23588.21930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec5116a-9488-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786344858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "3a5fd375-d0ff-4982-8b03-ee548e1d1a3f", "comment": "Malware payload (Mirai)", "value": "1afd57699bb5f7382dcbdaa74c1d9a89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "eb930c30-3203-4582-a04a-20d61fb7c422", "comment": "Malware payload (Mirai)", "value": "6690d52796a3b194421dcadef0f57c71a12983c5435cf234bd2014600e4fea28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "2e817109-eb68-4a4e-9e9e-c33fdd06e0de", "comment": "Malware payload (Mirai)", "value": "acc453e53e95db62a60118089ddbbcea2541192c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "11fb2ada-e305-4de6-84a6-a45322ddc5db", "comment": "Malware payload (Mirai)", "value": "0d7c76e808f633b847df569b6a23f35d3b47d04897c5d13ac2c997e0f8010d72b72a8956cc1f2889945b4c52daba22b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344858, "uuid": "2e4d297b-f58b-4326-a982-e8ff24056945", "value": "T1A5B43B51FC519B96C6D12ABFFF5E828C732317B8E2DE31129C154B2073DB85A4E7A181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344858, "uuid": "4a88869a-2405-415a-9f8d-f878949becee", "value": "12288:8K4/cIW5LdrdREbeDhPA2QLOfV7ItO+sFgU46OTYkFbxe:8FQ5aaP0YkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344858, "uuid": "6f066cf0-354b-4d2b-a195-e7a6ab752ea1", "value": 509664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344858, "uuid": "ad117dc6-ae28-44bf-ac35-94dd86fd5703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344858, "uuid": "9d7c9a88-b91b-4af6-95a6-bd30497a1856", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a816c6-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "a5db62d5-9e79-4c58-87f1-e9199b794c25", "comment": "Malware payload (Vidar)", "value": "6f36472ec84f282a78b5c0f5fbcba6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "5f813034-9da9-4541-a8f3-063f7008de73", "comment": "Malware payload (Vidar)", "value": "6705d7f08110e194abae44d687f3fa9bc4211a941f4f5b23872426154c43b5a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "1f2b522a-aad7-4c99-af23-34ac614d5cab", "comment": "Malware payload (Vidar)", "value": "1168c742943875f7cc225a9753d4362c2303307e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "8d712de3-e43b-45a1-beb4-f29e8959efe7", "comment": "Malware payload (Vidar)", "value": "b009d35758dd888de14f682988e5f281011e9522a0e285de2508829a0d0d48fa207511d87111616433a218dc8649c4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "a75fce17-527d-4ea8-bfb9-1ad46582409b", "value": "T1B8926245E11BAAD5C0E5C336A32A42A755F8782422365B3B5FDCBB7E4E42330E7502ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "f85e7275-0415-48ab-878f-3a06cf5601c2", "value": "e94e649e836c8320627dfabdbb134df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "e6ef8ab5-7241-4ea4-a0bb-62d3c0a2dc36", "value": "384:O0vwQ7EcVeSMbcfjQPlD6XAkZNJ5kfgBAKA6E6r3/Uq963l:l7EEet7qZNkWnA6Ehq96V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370450, "uuid": "6c0ec693-03f7-47fa-8b34-ef4b29b53142", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370450, "uuid": "4e88f408-f1b1-45ab-b6d9-de307fc851d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "e92958e5-78ad-46c2-83a4-a03eda2956a0", "value": "6705d7f08110e194abae44d687f3fa9bc4211a941f4f5b23872426154c43b5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e6d524-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "d677289c-9ca1-4572-9b12-e72c2af65b6c", "comment": "Malware payload (PureLogsStealer)", "value": "c73f4c30e4cff955e0321b42cf401043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "4218c627-981e-487f-9a6f-2ede04955afb", "comment": "Malware payload (PureLogsStealer)", "value": "67136c1a6435b4a749258300e446d830e0bb355db942d789c482e0b7e29cb418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "dddd4f23-27ca-42c9-80f8-e35364aac2cf", "comment": "Malware payload (PureLogsStealer)", "value": "671c517ef37256425e6fd514d3cc804e443ad30d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "c17b2f71-071b-455e-83c6-cb18d656990e", "comment": "Malware payload (PureLogsStealer)", "value": "93bab17b4e8e45b74952486bc2b6b7b3b3155c0e73a46838685d8bc28aaa0a979957caa812b2be3d333ba92178184d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "64893714-bb44-49fa-b1c3-49da7075a7bb", "value": "T13F7512040312CD46E0D687F6B9A0D27432B40DDF78E2D286DFE66FF7392978259992D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "857073a8-4c00-45a9-84c8-4b986ed6eb03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "f4052bb5-f943-4833-b207-6e0507b9fc58", "value": "24576:Xp50D3E5zFwo7ncEjYcbf+d4v83fObbEQeMy1TkFB/GbuMUsqFr5ffuXl5:Xpz7cPcbJvtEQejuB+buX7ffu15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373455, "uuid": "a6d8e3f7-b29a-4d4c-b073-857998fa23a5", "value": 1666560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373455, "uuid": "7da3f83f-8030-4012-8a61-d34e94d70ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "4dc41636-79a2-4746-8a6f-eb679e0af6d7", "value": "67136c1a6435b4a749258300e446d830e0bb355db942d789c482e0b7e29cb418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeb7d69-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "a4d63093-3192-43dc-b560-bdf65627c277", "comment": "Malware payload (Formbook)", "value": "3898c5efb6bba69d5605e7d4a00176b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "4786ef54-1ec6-48cd-b5ad-c766fe195b08", "comment": "Malware payload (Formbook)", "value": "673b0804edc54bb48d24da3e6fccdcf193b737bbf28ca448e215c1c63d5acb0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "f2413c4d-42c6-45fc-8a89-fe5109e1c8aa", "comment": "Malware payload (Formbook)", "value": "2b9df7d1ac163787ecc0fcd24a78560f21a7f667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "20d4ab07-d7e0-4c42-a4ce-58788ebeb03e", "comment": "Malware payload (Formbook)", "value": "7ebd1b1c3233060ee4ad63d22307f8d04f7c7bf3c816d5a703629fa1973b1e4baa63edd852a518718211f1545d43b424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "b7c9e1ae-8695-4667-95e2-a88cf0f1eaf1", "value": "T10B2523657AAA5B56F9772BF40E79E23017B53CCCA230C6062EED6CDFB951B040818763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "65c714d4-0229-48a6-b02b-3ef47725651a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "455af199-9ec9-4028-ad68-c0ce680b3f65", "value": "24576:XHu4Ceugd82b3ba/7Az53Zg2PKx2rkq10JUhDLN2PbQp6z:FCefd80b27o53ZgnYkq6UJJ2K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373816, "uuid": "be56871e-2b1d-4e93-afc8-b8642262c463", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373816, "uuid": "73f407af-c1d5-4534-92cd-93f36d3fea08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "e9f32748-35b0-41d1-9a33-eb0140906341", "value": "673b0804edc54bb48d24da3e6fccdcf193b737bbf28ca448e215c1c63d5acb0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800a649b-94f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "93ad055e-99e5-44d1-8158-248481a6e98b", "comment": "Malware payload (Mirai)", "value": "ebcb0c5756b6914a4510215f2233a432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "03ed9daa-2d70-4d7b-be1a-6897434a8da6", "comment": "Malware payload (Mirai)", "value": "67521b720fb08e8af5b2696494bb62b5a76fd9f41c0d571fa733dfa0a88df42c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "d893d58f-d3e0-467a-8c3f-4943f6afe780", "comment": "Malware payload (Mirai)", "value": "fc4c848b332150a4dc53a0167eff50c48b8d071c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "b1fbc623-a451-45c5-b8da-c34d722ad8cc", "comment": "Malware payload (Mirai)", "value": "b58dcd4dc439cd034325f69fe514f7fd8bde3723e5b9b5038bde8b58fc5ef0e8688305b16a7a4e3251b98b90e7707809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390467, "uuid": "c90b8b44-8428-4359-b0ee-f7cf7d773fe8", "value": "T131E3AFA7F74F6050C42106F81BCB5BAD2E2365018E6B9AE76C6E363E16375DF28053E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390467, "uuid": "f6c636e0-0415-4dea-99fe-400251a03294", "value": "3072:5WM93FaxuJWOjYyFTMCb8t0T09eJgVC/vhEdImHiq:5WMb8U2+7bseoeSC/pEAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390467, "uuid": "719c98c8-2f68-4660-a8c0-eba6b72f8b5f", "value": 148948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390467, "uuid": "299ac337-d2ea-4ea4-88e4-c7884a039d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390467, "uuid": "4c42e045-e414-40e6-b917-dcb187fc9af2", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4210e9-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "4a4103e9-1497-4220-bdd2-27e957a58cc2", "comment": "Malware payload", "value": "130665e02247028bf5fbdcb58282b08f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "c72aa872-3d07-4df7-a492-1b0b5ddee99f", "comment": "Malware payload", "value": "675259f8dde38c916f08a70d601952fe2397634a79b052f258ee97455973b824", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "08e3a734-24e1-442e-b5a9-4f1f5a5f7894", "comment": "Malware payload", "value": "c5257de0a7ba2aa0b089edd1046b4401674328fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "cdbd8673-893b-40ea-b177-8933d36ab406", "comment": "Malware payload", "value": "59753a2a2040cdd0ae398c780e7e1ceb707754bbaaefbe3808fb8e5903209c811d7b6b75626713a85ed5b206463053ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395319, "uuid": "3a262afe-fcd5-4cd6-9697-4cd6ab68d13c", "value": "T1EC016FC9D27096105029E96D72DA61A0B821C3C745470F647FDC953EABDDE14B026F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395319, "uuid": "6c08d71e-14f4-4f8e-b595-097b53cf031c", "value": "24:kXCKysE2hi0ziQvZohauXQEqzDXfl91zK7:e9Qp+MsmQEAXf1zK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395319, "uuid": "49235de5-6bb5-40bc-8c3d-7d4c48591f80", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395319, "uuid": "d3caa180-6429-4008-99e2-959c09c3ae70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395319, "uuid": "d8a4d9a0-84f8-40ce-8d1e-658aa7465d52", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e5ac54-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "f4a2f7a2-aee6-42a2-80c3-41664be31c7f", "comment": "Malware payload (Mirai)", "value": "0547a7edd84f6308e6ec537d62b01d74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "3c1d8a2b-36af-4d65-8db1-b6a9fbb0664d", "comment": "Malware payload (Mirai)", "value": "67817aebf7f8ca1618ce4dec8937f2f69888d15f34fc03777ae008ca36d2f44b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "d1c230d1-8087-414c-b570-1c3630c31893", "comment": "Malware payload (Mirai)", "value": "7f444335358869490869ad15ddfcd9d9bacac066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "2cc8ea07-6feb-458d-89d1-2834ada22119", "comment": "Malware payload (Mirai)", "value": "3aa5ffe5e5cee4c08acf0079c61292363a6ab8ec42bd6ae6c298735c2fccac4fc5a9647d29c8c7746d06d45ea2c499f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353829, "uuid": "4ebd12f3-fc9c-4e8e-826a-ff7238fcf60a", "value": "T17F258D1AB2B2F67DD00BC0304BDBCAB14132F07569322D7B32C5DA343EA6DA51769B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353829, "uuid": "265c35ab-478f-4952-af62-28dff85b3ee0", "value": "12288:iad6DCNgKL6dQusl1tUBdoHfjdxAOEDapo1UvODHaypCoaHXZ9ul/mMAXA:iasCNgBnudKp6o1YOLwkl/mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353829, "uuid": "18d46376-5d9c-4650-becd-9c9709373a14", "value": 971096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353829, "uuid": "6d9e6d34-dc64-43df-b3a6-3cb72d7dc260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353829, "uuid": "014268e6-6b01-4614-81b3-565af761cae1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262a9a2c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "1fe74e50-9612-4d22-b98f-ef09ce2f4d5f", "comment": "Malware payload", "value": "ccb10278282b814ec2db61a4d6cf49aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "8f1f8f65-31b2-4f41-a549-0cc0b64480e1", "comment": "Malware payload", "value": "67b2545630c4f42fe0d6f310609ad154e5218f566c0137c112c78939621a8ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "0a3b153d-4bbd-49b8-b40a-88b48b9312ae", "comment": "Malware payload", "value": "6e8da76bbc35b4489a1838419b352ecc3b068a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "28d5c0d0-5902-4f0a-b52e-298c73e2e14d", "comment": "Malware payload", "value": "775fd25dbaed4f77b112207806e78ebf124a30fb7a36530dfeb1d9457349b0dee839c47c31643d6966a2bd642a33a7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "9d28f7a5-d701-4c99-8bfd-22e468fc6b54", "value": "T144D4F100D685C8ECDC3653B2887BED221427BDBC94B1652F665D76397EB3382507AE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "bf0fec55-0819-4601-8871-bde59c891281", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "68ba79eb-8dc9-439c-a9ff-e4e371575731", "value": "12288:NtgBWX5wf5EDHNgu74qF8LVZP2Ra08rECC6MB7Z0/sg:NQw7DHNjcA8ZZPwAE3Bl00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372277, "uuid": "ae44795a-c927-49de-87e9-534caf1701dc", "value": 603800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372277, "uuid": "ed3e8975-562c-4149-a220-a86aba1fdd43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "1e38e3eb-d57f-49bf-9f65-08e77c196858", "value": "67b2545630c4f42fe0d6f310609ad154e5218f566c0137c112c78939621a8ae0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe095481-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "a599873b-cf57-424d-8f41-c78b04de3b06", "comment": "Malware payload (Vidar)", "value": "706760335d4d64e0fb48eab44af2a2d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "30cb5e6d-717d-4e88-8d39-47f14ba77870", "comment": "Malware payload (Vidar)", "value": "67e97760f461eedd9fc1d1db45afe4e3b4535aca73355ebdeaf873848342124f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "08064846-9dc2-4b89-9cd8-0e809bbc3444", "comment": "Malware payload (Vidar)", "value": "981d02788b78f1f0db838b23ade66165f247388e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "d6532163-6380-4fb3-9ac8-0d105b2b3c8f", "comment": "Malware payload (Vidar)", "value": "5f61173a8351e14ccaced61b4b2ca2fd0ce5390e9fffc9bb972548ba45e7027832c0f7be027b1e944bb009177c54703c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "c7f6b8f7-f1f1-4dc4-b785-c774cb91a39d", "value": "T1F1828245D01BAAE4C4E2C332636616A359F8B85022765B3BABDC6B3E0D02370F7113ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "6cddbc7f-012c-4f9d-985e-4b8b1e094d3c", "value": "16308a646fafd8cbffa509d4eda166ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "6ddcd8e2-d7fc-47ad-a64d-09295c549558", "value": "384:OUlnRYZkDS4UCYoEi6h9dsmnpMyb1IsYOsWAqZ04Hz63lJMQ:/SlFiqsmpMK1IsYaZ0C6Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368774, "uuid": "47951a3d-445b-48d7-8b05-7750b2b13657", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368774, "uuid": "6ac9bac1-3d0c-48a3-8b2f-11c84aea2ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "035c0fcb-4bc4-47cb-a0de-729f2ba8b2eb", "value": "67e97760f461eedd9fc1d1db45afe4e3b4535aca73355ebdeaf873848342124f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c945091e-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "2050e7e9-266f-4d44-af02-1ae76c2e42ca", "comment": "Malware payload (Formbook)", "value": "43d6e0302e5417bb79c17527ac21c72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "bcfe01ed-f5b3-489d-ac34-f37c64fa2750", "comment": "Malware payload (Formbook)", "value": "67f0f61d70d2a446284e7b703b1c780908ffa289ef7018310fc8165c830d2bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "7ec2f5c7-0eb2-48ec-bbcc-d4dbf24d15a8", "comment": "Malware payload (Formbook)", "value": "2c080ba0c4ff3f68ac61d3a31f767c0b5f3fa400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "ac881214-a9c5-438b-9c6f-4802f0d41838", "comment": "Malware payload (Formbook)", "value": "07298e6df41f3c4ecf69c30ada55ac5688cd110f7fc620bab6476fc7daa3f15322263aec2b4b9330422d0b94ea763460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "05c83c22-cd63-433e-b2ce-f9de24a404c7", "value": "T1B93512A86B1DE80AE9525B340C70E27C15697E5CEA11D3676FECBEDF79327164C80382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "e778fc46-1dc1-49d1-b5d7-a236f1ad4f60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "df6bceaa-72e3-4c55-8375-a1985165d9cf", "value": "24576:34vV0LPvFiqSGdxtTrLmNN8+vbnLvhndftnt9lhz70+vaD1U:34N0LMqSGdxhriNB/vhhtntVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369545, "uuid": "6dbf3419-f52d-4086-9569-46292d4341ed", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369545, "uuid": "2cf313d4-22ad-49b1-982c-631f16cb6898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "4ba467be-9b27-4f16-8ded-c10cc8521fdd", "value": "67f0f61d70d2a446284e7b703b1c780908ffa289ef7018310fc8165c830d2bc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bc24f7-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786371582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "3223aed3-cb40-464b-8101-57c1105ddac1", "comment": "Malware payload (XWorm)", "value": "67ecfdc72066ed3e3f7d4c83077eb920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "bf2615aa-fe1c-4d5c-bac3-c6bacc260437", "comment": "Malware payload (XWorm)", "value": "68075d0235b433a37fd896eb7b2a2e385cd5c65c34e6b2d0a1f913608d53f454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "afe13a37-99c7-419e-80a8-069c86575dab", "comment": "Malware payload (XWorm)", "value": "f65630bd94ed4a6f7150d038b8593e9b51a1d02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "6cca3be0-f160-4a29-83ac-be75a9b8002a", "comment": "Malware payload (XWorm)", "value": "209c796c4a6e73c9516d78a8e864da445d25cb3d3278ccbe731b33c53a85ccc5854f14e918ab1a67a0471e2bde8b54ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "93c7826c-ea93-4f73-8e12-5fe931d8280b", "value": "T15384F13D2FACD25AEE720F355CE6F335856C9EA46D518B8B770839297E30F809C49219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "ce62e33d-8f43-4890-9060-f49cf1836b7b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "984d7e13-a7c3-4d7d-804a-62eb6da61623", "value": "6144:XT4DtYa/h305o9fgqMUuBQWYmETquqsP7ook3FHPGavEhIWjxKouGuzz87:XT+Vso4DUoQFmETbqsEoEhPh8luGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371582, "uuid": "18017903-55d0-4bff-9628-279f50d453cf", "value": 383928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371582, "uuid": "9840db03-9efb-4ec2-9912-2a2a74341318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "e72c53a8-e4ab-4068-8584-7423d0c71e18", "value": "68075d0235b433a37fd896eb7b2a2e385cd5c65c34e6b2d0a1f913608d53f454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cab1a79-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "cc792b89-6946-4e60-8f72-c5288705bc24", "comment": "Malware payload", "value": "972ccccde3fdae532452aed62f51ce52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "b6409541-9d0b-44b4-81ad-0acf5d6913dc", "comment": "Malware payload", "value": "684e744797db2a1aad3708af26385b4940d07126e2456521b360d9d35ef01b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "183e5ae7-4535-4c5c-8e14-1290cb09c65c", "comment": "Malware payload", "value": "3a1c7775db1586d360a2339474dd783ae97fae87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "ad7ae874-287d-46b4-82c4-aaad92f6b3c0", "comment": "Malware payload", "value": "73e4b7bc78c394675b86933394bacd4d523be048039e65d995c5ae55ef00614569df0311e6a036477641d5d2b478c777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "5a3f855e-c9d0-4136-acd0-1bce205dbfde", "value": "T15BE6E03362ED65FBE0694639057392155E3B7F3068138D0E96F438F8DB35FA0293AA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "abcf2283-1236-4989-99d9-00b158a5fecf", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "32a3ac41-19aa-4c6e-be7b-7a9935c69f10", "value": "98304:6oJJqi90iHyTTGu7Eb8tI9eHAr4y+2fRQBEK6:5X9lyT6uGuI02fRQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372047, "uuid": "48f4dca9-65f4-4e79-8e67-4a7b182799c9", "value": 14601458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372047, "uuid": "e0965b05-9551-49e2-870c-88608c9f04d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "46226089-e2c7-46d3-819d-abae31378391", "value": "684e744797db2a1aad3708af26385b4940d07126e2456521b360d9d35ef01b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b16cf2-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "3e1ccf17-9857-4039-b0ee-75f1ec0fc0bb", "comment": "Malware payload (RemcosRAT)", "value": "acd23e712bd02241d422166b68a4062d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "18264b6a-6ab2-4e51-b564-5553e66aef7f", "comment": "Malware payload (RemcosRAT)", "value": "685a9bb96c43e93da315358e0b572334a3c27b1ff5746a406e2b4d9d2431915f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "77168554-82ac-42d3-9230-9d11e8f39fc3", "comment": "Malware payload (RemcosRAT)", "value": "1e0df63eb22c3af4887e6bca4d2a4855a7f19200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "e93e6912-7825-4164-b687-f8e03e3b66ba", "comment": "Malware payload (RemcosRAT)", "value": "a84c10469f305658f0bbfeb25db621dd9f6b34f38c67f1c5ee951a2a10bd3ec1160772cceed38cff2d32f6594669905e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "9eaa1817-5c35-4276-a933-dc7149e9515d", "value": "T121F412543A614B12DAB20BF916B2E1311BF56DACAE32D3062FC56CEFBB57B504818713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "7de679a3-d8c0-43d2-afd9-4351caaea182", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "d720c097-7406-48c2-8f82-cabb5bb56bc1", "value": "12288:80udLXqwCvXqtHMGMkQDffz6sTJ6ipGgKAP8PAQfSGhBYJ4FAoC/yozdvzAi+Pzm:tudjqFXqpXMHffx1GgKg8Plk4FqPxhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373889, "uuid": "babcbdb3-b2fd-486e-bc3e-66ea3a656fc2", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373889, "uuid": "811c8577-9001-4386-9fcc-da9434262b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "d12aa632-abbc-4e2d-9333-fc7565933f01", "value": "685a9bb96c43e93da315358e0b572334a3c27b1ff5746a406e2b4d9d2431915f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ca5395-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "e1e8e181-4441-4b9f-97a0-093b3cf420e1", "comment": "Malware payload (Mirai)", "value": "6f9d16d81f123608309cb509fba65e39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "e3743630-6f02-4be2-884e-140a3efea6c6", "comment": "Malware payload (Mirai)", "value": "689a56e6252bfcae50ec716f3b736ebc1a21bf6a47c152e0a59ab41e21151aaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "465e55b6-e0dd-4962-b83c-df96706cea27", "comment": "Malware payload (Mirai)", "value": "358d82cc57f2fc32fefc5e41a1618522cf304486", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "226d2023-551e-4baa-8c57-a0539ac47682", "comment": "Malware payload (Mirai)", "value": "40596b374135c5615f007eb221df367bbfa8af95c2f44f345dddffb201942db365b608aedaddb89ff08ca7b9aaa25ae2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "0fe776a2-d76c-4c75-97e1-be8db192a9ae", "value": "T18373F183459EF675CC6EB1723AE749C1A691ED7CED021FF781C930BC885A846D8A1E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "a77ee4d3-46ff-486c-bb9b-2b499a45c6d8", "value": "1536:WEZPirpVL/2lE3IXsstWu2inReU5kXAm8+n:HZarbL/FI8S7nr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383600, "uuid": "92476371-fbf8-4bcd-8bbc-e98cd580c999", "value": 76920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383600, "uuid": "814867d4-1566-4baa-92ed-13ab5d2f54e5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "7a0039ff-c318-48d3-8b87-3449bf5a8807", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7fcd07-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "9b7360ee-a0db-4723-8678-d82de7305d73", "comment": "Malware payload", "value": "4b39b94efe19d4427e3fe525bd85a301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "9c83ec75-0d56-43d1-b99d-4471a6239bb0", "comment": "Malware payload", "value": "699cf1475245e5fe1b790210c97731ae80fc471b9fecbebcc48b28b387757f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "4160a03b-c528-4854-8a36-ba225dac5e37", "comment": "Malware payload", "value": "7b86941c422262755f63f66da071bac2f85d16dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "1e8fe6ad-9495-4c17-bbba-b9023826d4b0", "comment": "Malware payload", "value": "330c31b2e45fd6c5e241c55b817382118c0c1753409e496ba9e3c2d4819c6a0c74f296fa57632d49ffc61efc6692725b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "03cda386-448a-438a-a312-b01c23ed0a9f", "value": "T13B04021473C9C067D6D3177228FBA2B6A2B6EA680133470B1788BF3FAC317159D1A795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "bcb5a647-4f41-4c64-a49d-817af3b352b9", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "dede776c-f058-418e-a712-0ab5b90f89af", "value": "3072:1LfVxlyEZfp9zIb45zLNYw6bJrXHB1BHaRsfHUwJ3C7Jn+aDMHtv:ltXZXcMLBS4sHd32kV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372397, "uuid": "fb17c6fd-3f01-4a8b-8304-bc500aba23fc", "value": 183788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372397, "uuid": "9ec4316e-0487-4c41-8047-dd5dee709d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "cb4a0fb2-8103-4407-af96-dcf74cbe2659", "value": "699cf1475245e5fe1b790210c97731ae80fc471b9fecbebcc48b28b387757f74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d355cf-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "52ee5f1f-e8d4-4fd1-b926-8ca0ee37b4f1", "comment": "Malware payload (Formbook)", "value": "5a174b868ca2d317f5d9f49aa964c88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "4d0b7cf5-cc0a-465d-926c-a953661e4b87", "comment": "Malware payload (Formbook)", "value": "69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "1b93ca58-064a-425f-88fa-8b5541789f8d", "comment": "Malware payload (Formbook)", "value": "ee108ff77cbe984c4bb33ec1d9c16ce1577b34e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "5b5eabec-edb6-4ecb-8ab4-a331fcff384e", "comment": "Malware payload (Formbook)", "value": "68bfe6942dbad340e72b4afcd94c0b03b0b9c36b076c0f90f1841248b3663086d1d5eb094bab09b83d307f9125db8c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "86bf393d-4d3f-4527-9d7b-7012d403995f", "value": "T12B351255ABF6EE35CA6106BF8705F6315F2E6EC58170FA8969CDBC633DBBE004400296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "d83889c7-8e78-4528-9c8b-02ace6e630b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "c818776a-1948-407b-aeb6-156703ee1127", "value": "24576:1NK2aycKGl/VAtK0UZIKXQbKVK+qok/as2Jr+:6DyfiVAQLXaKVfqoKas2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373674, "uuid": "682cb48b-06e7-4a68-b3ef-b5fd0eec666c", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373674, "uuid": "c195cfb4-5198-4eea-87be-e6923553b0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "a32156ee-4412-4fce-be55-57af6ce8e1b1", "value": "69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511dbb84-9451-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786321239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "5b6477c7-856b-4d67-906d-2f4ee78fae60", "comment": "Malware payload (Prometei)", "value": "0ebf523f65ced692e45eb1f6367d4e95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "bf4bec5a-f7b2-4e3f-8e3d-b0040d2c1ec9", "comment": "Malware payload (Prometei)", "value": "6a207057c4750722c439c989b3270a6ccb60129a2d61b86286a3edef1f31e649", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "ebd2082d-79c6-4bfe-824c-a57e9a1606e4", "comment": "Malware payload (Prometei)", "value": "6ccd1ea583ac5571dbec293710b92c7acd8b49b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "4f63117f-6fda-40fe-8de0-526a99197fd0", "comment": "Malware payload (Prometei)", "value": "64e500b64c58233ce6bce9a39206f1c17b269da1503f23c21932939b46c7e1130b870dfa13b3ba52bbc27e2658b8fea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321239, "uuid": "bc63e7f5-8e88-4741-b2fe-0edc80081678", "value": "T16325337DAF1C9AEC433A971835B1D24B8EC1F8967B27540624BD82F853EEDD36C12468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321239, "uuid": "6b0ff370-ebb1-4dd2-b0a6-c1966094cc49", "value": "24576:lertoMkebO9ErP4/kuxwn4ZCKBAvck/X3Sh5GrMOZrwUUkya8:YrtUegEsxwWb+vck/XialwAya8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786321239, "uuid": "e3a5070e-def6-4448-9d03-39e4172dc2d6", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786321239, "uuid": "e5b22741-d88d-4a7a-8ad5-38ff02c1e148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321239, "uuid": "7fb1c405-7672-4c99-8e69-9fb125c60268", "value": "6a207057c4750722c439c989b3270a6ccb60129a2d61b86286a3edef1f31e649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd6b40d-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "b22f170b-241b-47f5-b7f7-cadb47caf610", "comment": "Malware payload (Vidar)", "value": "86c1d1278d6f71466c35ca8d8a4b4505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "46ec4ccb-1534-495b-8c6d-6d5b6aa56f51", "comment": "Malware payload (Vidar)", "value": "6a2ae68bc27a5f0c028301f2ec5417572d5ed1442af1d9a95a29cf02855a66c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "a316bb4f-e9e7-4359-9056-8ea99581da09", "comment": "Malware payload (Vidar)", "value": "8789dd7592c1783e05cbf9e60aaf0809114134e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "a56c0de1-806d-4ef5-af83-2aa362aafb30", "comment": "Malware payload (Vidar)", "value": "fe6d7d8082dd54cbd3cec609f17cfc982025c8b5b93e09091b32aa6ae5482d01b7d880c4e6c6361b6a07ecd38a9f1c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "b7afee78-7834-4754-90dc-e9fc1adc1662", "value": "T14A922E45D21B92F0C4EBC337675A922365F8BD152236A63BAFDC56355E42330A7182EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "a6fafd9b-d094-4dd2-83f2-857ada0831e8", "value": "1bbed67eef2c885e172f4ab0f7e6b4df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "f63f28c7-023a-4419-ae44-ecb2bedad3be", "value": "384:OEi7Po5XSgtVinfP1Zygwi9lEffEIc9pP+BZXwcF8hb8lDH:UPYXSJCg7lfJcZXtUyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370462, "uuid": "26fd7aa0-c706-4775-95e7-594b18f93c1e", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370462, "uuid": "d0ccf7ed-a1b9-4d56-a1f4-d7f01758e6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "850d4a21-212e-44d3-828c-b6bdd9908eb3", "value": "6a2ae68bc27a5f0c028301f2ec5417572d5ed1442af1d9a95a29cf02855a66c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690a38e8-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786369383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "e8c87248-e18c-4528-a5d9-d3928830a5cc", "comment": "Malware payload (AsyncRAT)", "value": "dd8e33c02d8e2fb04e2fc55766d77b84", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "734ed16d-9f65-4c27-a57d-b04273b75acd", "comment": "Malware payload (AsyncRAT)", "value": "6b555912da38f884965345b7012569f6ad38292fb073157b4ff4fac15a00cc26", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "1b1a2385-3c22-42a6-bc44-0ebc6ed0a8f5", "comment": "Malware payload (AsyncRAT)", "value": "9472dd4c5eda5cbe9a91a7d5770d56c247bcc5a3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "49d88577-d4d3-4419-b123-eb7ef9123431", "comment": "Malware payload (AsyncRAT)", "value": "fb329cfb7af7bfb5b2bfb1d09de5771bd942696b2df378a74f4093b9716de74a26ffdf3bb3a999700eff428bf99502fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "a9826919-6f5d-4fac-b48a-36e423830e1b", "value": "T1BB15F10467A8CD03C46A5774A8B4E2380B796E19FA11E3174ED4BDEF7DBB7228C54287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "af93dc9d-9a2e-4414-9402-d1aaece03a75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "35e52395-6474-4062-982e-0320355939d1", "value": "12288:iLYxXAvNZVXEcOzygcCwIj1qOIFVET3JS8b2DAYpUho3fW8da1dLFACgy:DAvvV0Lm8PKET3dWppl3fBZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369383, "uuid": "30e6fb07-0f3a-44c4-b961-caeb6f627ec7", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369383, "uuid": "7244515d-f51f-42c0-aed4-7d7668b78ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "f41800b5-74c6-422e-b83c-64d7f1fb56b2", "value": "6b555912da38f884965345b7012569f6ad38292fb073157b4ff4fac15a00cc26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb7a02e-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "b6bb56c9-0129-492c-93d0-28f3e9ca0178", "comment": "Malware payload (Formbook)", "value": "71a62992b2883cc9fe6f7f73b37a9607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "abb34139-d1df-497e-aa9e-87dad613e84a", "comment": "Malware payload (Formbook)", "value": "6ba7f0ca733d826c160f4ad7a8e49b3ff673defb477c47b0621b048baac67450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "a2c43fff-15e6-454c-8c65-e062bab90f2c", "comment": "Malware payload (Formbook)", "value": "0d221af75a856028db4ff589c8de6c6b69dabe27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "09f4ecfc-8dd5-493a-ab3a-fc729289417d", "comment": "Malware payload (Formbook)", "value": "22d40489ebf97717d21139ff11decfcce419d3888d6989233c3db5bee3c120227d2cae3500b5b8b9d454a9022a5c87bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "2a74796f-34a2-4f9a-8400-1314fec9552b", "value": "T17325232516D88E17D8BB1BF942B1C43527B57CCDE939C6198FDB2CEB7896B200920763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "71458de1-0ec3-428e-8027-549e9ff418b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "81fa45cb-ca4e-4957-a452-ce37f972827b", "value": "24576:bGK5Q2zG1MA4Kcj6Sq3RpIGNK01U1GlKoh7xV8sl7zOfiX:yY011T2MKKNRYiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373822, "uuid": "56bfb676-07bf-493f-bcf8-c0ed9d5459f2", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373822, "uuid": "7b4e3e95-112d-401c-a306-f5a8b724e258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "488fee8b-bf83-4830-8026-c040b2d46c62", "value": "6ba7f0ca733d826c160f4ad7a8e49b3ff673defb477c47b0621b048baac67450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747c625a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786371120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "25330fe7-5a2d-414e-ba4e-984200c015a7", "comment": "Malware payload (a310Logger)", "value": "e1ae133210bcc6d46f40dc4284fc97b0", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "f3e8b3bc-91bf-41d6-8048-40fa5e09b55e", "comment": "Malware payload (a310Logger)", "value": "6bfc1a89a58ec4a73de17f7fdb3e8b470c132e7410fd8a7f4fe9b4771159e08f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "bd44bf09-6ed2-4f34-99bd-d0bc63984421", "comment": "Malware payload (a310Logger)", "value": "d395f90ef96411a71c9714baf88ed2bb59d85c76", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "0f331d0b-a04d-4274-a185-cf6d9e631f65", "comment": "Malware payload (a310Logger)", "value": "0d701707162c0c41eca929b21efe24c7bbb32d932fe81e07b0c35d2dfec3a28a94054bb13bf96ed0136d557a28ebae61", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "9daa320d-bf46-4e9b-b43a-d7d425f7dd69", "value": "T1DF944A13EB60A11EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "522a7ea7-36f0-409e-8e1e-9becc3e84766", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "86efb211-b070-48ac-b66c-ffa19e8dee9d", "value": "6144:O+8d1/w5KA81IJ8GpF6nuTmOOUiBUrjWBg58zNCQWFiuSxcbyuXu/lD:ajYKkJj6GmZUiqrSJCRpbyuXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371120, "uuid": "88428309-39eb-40ff-ae89-29fb9ed1817c", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371120, "uuid": "6ae8e6a6-b9fb-4afe-b71d-4e45c3793910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "14783efa-d0eb-47d8-8556-bc3adfcf40ea", "value": "6bfc1a89a58ec4a73de17f7fdb3e8b470c132e7410fd8a7f4fe9b4771159e08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5339b9d9-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "10feaafd-1907-4913-bdd0-b7875d47e07b", "comment": "Malware payload (njrat)", "value": "497071f4d0445ccb26bda1ee0056ade7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "3453c00f-b15c-4b2f-bcb1-86be667d95df", "comment": "Malware payload (njrat)", "value": "6c09247849aa700f0c79a851fc08db8a0525a52d8bbcce5e547002ade3617c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "94ce3105-52ed-4364-ad3a-d4b2a22153dd", "comment": "Malware payload (njrat)", "value": "1fb5de54ccfeb870d8da0185c909acd345819c8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "78a333b4-89d9-4b32-a93d-182162275de4", "comment": "Malware payload (njrat)", "value": "bc45c74eacddc363346414bab282c1a942c2e8a21d0f663fb1619be543213ae417b55805133c56f36dc75fc27ef17e94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "0ae3fdd9-0a51-41aa-8156-f9f5ad654a37", "value": "T1510522146F16DC12D4D24BB408A0F37E92705D4CEA11EA978AFEDEDB381D90B9D09B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "ba6a25b9-9101-4be4-84fc-43d1d4a1a2a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "2727e1ac-00f2-4035-b1e0-9a6ae055acfa", "value": "24576:JP/k1AjRJACaeAhihCHy/6PAVjBJuNGCMJcZJA:JPM1AvIxhm1/6IV1JuNRMqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370635, "uuid": "1ea9ae3a-3fa0-4e08-bf80-5abbd8178ed9", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370635, "uuid": "cbb74993-9815-4529-86b4-ac5c269cf1fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "6a3dd17a-897d-4cc6-bf46-9b58945a267c", "value": "6c09247849aa700f0c79a851fc08db8a0525a52d8bbcce5e547002ade3617c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7324bf-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "b3fd6104-d844-4c31-854c-f7d663ba34b0", "comment": "Malware payload (Mirai)", "value": "5deee7c9ff907aa242aa066f44e17a9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "3d199469-6ff9-4112-b7fc-7709552c33f2", "comment": "Malware payload (Mirai)", "value": "6cbb8331f5387b638ac0dcc8d5c75a95c85c36829651f0943cd7b5d874c51b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "9014fe7a-094e-446d-a4b1-c1c187eb3be6", "comment": "Malware payload (Mirai)", "value": "85408120be040ec04de189fa7feb75197cec8bd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "44a241d9-8b10-4c0d-b595-fb3387319bbb", "comment": "Malware payload (Mirai)", "value": "86e4baef84380be9e5d9933614bc76e75aae655662f66e044808e624f586460bdf1ad55033046e5f9c52952ad1399c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340208, "uuid": "55ff0037-ecc6-4508-8571-93e543c1362f", "value": "T1EA840C98B5F2E2CAD1D4EAB5F319784D37530776B1D73146A50EDA3322EF18809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340208, "uuid": "e764f27e-58cf-4d4c-b318-71b7f8c2526a", "value": "6144:ihlYa9szsODsj3JsjdFEsvQUzZVJk1dj4WAsgHd0g3SIG:ihlYa9sIOUsjX5nWJR00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340208, "uuid": "64c67f52-2bf0-48b4-9cfa-8525f012051e", "value": 397360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340208, "uuid": "05c0ed12-1a97-43ab-9067-0d8fd4f5ef37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340208, "uuid": "b032c0d0-1ce5-4922-94b1-59945546dcc3", "value": "vlxx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5550874-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786368625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "3c7e8aa4-2829-43fd-8542-fff719ec2d06", "comment": "Malware payload (a310Logger)", "value": "5e8eda40b07f656d2830ef46a511f257", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "b09bd773-9fdd-43ce-bf2a-3667a175ec63", "comment": "Malware payload (a310Logger)", "value": "6d32ddd615e27531c7330421698ad4eccaeb96b9eb6aa5b0fdb5a92ebe5fb4f1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "d53b2089-dfae-4ce1-93b7-67633cbe57c1", "comment": "Malware payload (a310Logger)", "value": "4492295a63f3f3e5bd2101100d2dc77e264aeace", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "527efbd4-43a9-455a-b429-a9a25b85fb42", "comment": "Malware payload (a310Logger)", "value": "5bd1dd99c3e48b969133885aa0f44511835f437e43be781d167bf43894e277ee9cbbd9567b4bcbf1bbb7fcebbb9cd2d0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "4277edbd-6605-43b4-b020-5efd142592ee", "value": "T1625502C03B267709DEA86A748935EDB853A92D387010F5E22DDE3BD7B9AC2115E1CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "4f9dd73e-f16c-4deb-b781-9c2fd2a69cc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "04a7910b-0606-4a23-a2c1-725ba027449d", "value": "24576:WqGxQdftNe9ceTVc64AaIDqPAFIDdFx6rcEtfir2+x4E:WhxQNeXTVc3A5qPDjAr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368625, "uuid": "5df1e97b-5b9a-4caf-89ec-e2a3f5e4eef8", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368625, "uuid": "6f2e435e-e23d-4519-8ff3-4ba25aa73840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "f781e690-25b0-4f75-a7e9-af4f69293ad9", "value": "6d32ddd615e27531c7330421698ad4eccaeb96b9eb6aa5b0fdb5a92ebe5fb4f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac845c44-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "b8635ae2-7b8b-404c-afb6-b4cf23b8efc9", "comment": "Malware payload (Vidar)", "value": "c935d058a27d8a21cbe90f9836421acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "e97389dc-c15a-4a39-ad1f-7a980494623e", "comment": "Malware payload (Vidar)", "value": "6d3b76ff9cc0ab462e84766e2bd86f52f6a0480b0c40cfabf7780801d4eb5518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "ff36c20e-78eb-461e-8b20-a0606f146b08", "comment": "Malware payload (Vidar)", "value": "681c0aad26d76749b5526e463a1b69c8568e8d3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "5cba2b2f-55bf-4a75-91f1-b8db246fcce1", "comment": "Malware payload (Vidar)", "value": "ddc284dc3616e1d19317240d23b38860872eb395f2934b18488eaa1747403b51fc18c7d98b7e14c1219246f6226c6c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "8d838cdf-5f59-491e-bd08-f13fdfbc4e10", "value": "T16B52FA9AB1E1B2BDC0688379DADF0672DB6534C463345AFF12DDD7647A83111A2BCB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "e75f5fd1-f7b2-4c34-b9f0-10e924bda220", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "877a2e3d-9d1b-46e4-84d2-76209e4670e2", "value": "384:W8O0RUGnoh8k6sk3/X8cIIRmrS01KylwS:Nzxk83nyIL0Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368637, "uuid": "21a5b388-3ce8-417d-beb8-c894ce20b235", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368637, "uuid": "0f569960-a4c1-42d5-ba67-3adeda84672a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "b3a1f155-fbc8-4c82-b7d1-3437fa409364", "value": "6d3b76ff9cc0ab462e84766e2bd86f52f6a0480b0c40cfabf7780801d4eb5518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac147fb1-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "722d2f2e-769a-4081-99d0-d7f6d803967a", "comment": "Malware payload (njrat)", "value": "7282a626a48bd93b48c5dfb418a09f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "4ed79d84-011d-49ea-ba46-2e3656148d73", "comment": "Malware payload (njrat)", "value": "6d634ef3e9a35d3373b21c747969fb2d251179b56dbbc92f1f5b957c9fd7edbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "1f4de157-c0bf-4d0a-81b2-df5ee924fc33", "comment": "Malware payload (njrat)", "value": "a400fe43642420184a35bc1f65b5d78ad3a1f3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "f5bfba6c-e33d-4da4-9bdb-78b051189433", "comment": "Malware payload (njrat)", "value": "b77e686211aab8d014d350812baf89df44e3d382914ee6b9a95acb69a59b4ff4c20df5bd024935f354e394336421179b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "9db3ffe1-42b7-405d-bacc-49ccf78947d1", "value": "T15F0512942B5AD801D4E31BB564F0F33852709C8DFA11C357CAFEBEE77119A1B6C18962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "0f430ac2-42fb-4401-ad76-7c02df475ef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "270a2aa5-c9c9-459b-8139-6c12bd81ba89", "value": "12288:9k36ivvOro7yYzhODnJbu0Z00JAp6grpz65ixo9nKaG2qz3MrThPxhaNYfsYz:iGxTtL9JAEgrdWiQnFG93MXHhPfsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370784, "uuid": "08bde3fe-00a0-4cbe-a2c0-e556b970a57d", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370784, "uuid": "0c632d45-8fce-4615-8881-a9c44d37dd81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "a5980b04-5874-436f-8caf-694e8bc43816", "value": "6d634ef3e9a35d3373b21c747969fb2d251179b56dbbc92f1f5b957c9fd7edbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff65d307-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "762c55fe-fb96-4a24-94e5-8a54b8b33793", "comment": "Malware payload", "value": "f8e6153cd86bb5d3d93fc2643307f81c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "4aaa739c-1563-48e5-babf-745e0d2b6d5e", "comment": "Malware payload", "value": "6d64158bcadc565048d868ad38d61624ba19bdafdb88c1fa1b1035a2f108eef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "eff9051a-ce0e-4b4c-ad9a-9d51160ed9df", "comment": "Malware payload", "value": "6cda3449243ec6db2e46053c2acd7717d54330d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "b10e2391-0add-4f43-a0ca-4dba3d6c48c9", "comment": "Malware payload", "value": "708f06d4fa9de306e853c6c0d7a7ee9fa68f60f510bb127c1d5a152661451bc18d2853592d531687b840eec835a3ca01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330551, "uuid": "5c7d5182-473a-4f71-9835-f30f31f4c066", "value": "T151533912B388FEF1CE94393060C191B4134D1CF257C5A8E6E58CF2A4697361BBAAD79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330551, "uuid": "a6524c7e-9579-4c69-9f6c-ffc57a454488", "value": "768:0T9G/XIh7GCtBfcZbkh8eIxYR3/y6YHOG5DTLLpz0o9D6hhSeRE5:0T9GwhqCnfcZY8eIxm3/rYpLxNZ6hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330551, "uuid": "4db7c6c3-e8c8-4e9b-9c6c-cd60c5aa519a", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330551, "uuid": "9aad947c-b78f-4f99-8271-993904838857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330551, "uuid": "55c62c8d-d147-4468-9f5e-9df47204ce34", "value": "main.sh4aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f993dd6-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "b9a95cb4-4232-453b-b015-c54889c8db26", "comment": "Malware payload", "value": "b56e6162b9857aae36fd00d5e2ec0ab5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "cd3a92e1-1952-4b2f-a6b6-c2d12e58bfdf", "comment": "Malware payload", "value": "6e0cc362c4fb990304c67d1c6e4d60d429e400bbde2df5917a7a702c1c0f3b96", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "aa46fbf8-6fa5-4a6d-aa10-900b3d107b5a", "comment": "Malware payload", "value": "53d1e569077b6fe1f403b4799fbb381683c92723", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "0119f606-ca48-4a47-a0f2-3ab5117fe9e5", "comment": "Malware payload", "value": "73d796475ea1fd1c7b6df5754104ab261b2832d72dd297b6e8f4e1a5a4c4cb61a86d4a080d2a51197b642466bce18077", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349503, "uuid": "105529ea-582e-4564-83d6-3556ff633175", "value": "T18932F6CCAF9063F4F29303CD37AF2999136561CB504CD880F68C6DE06F4B68D4A86E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349503, "uuid": "e3049910-5fa0-4c83-8a83-0224f188310b", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfMFqBJILl9CX:sXX+/DV7k/3/lLAiYOpzEMIp9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349503, "uuid": "be53931d-0bcf-40e3-a57c-06255ee8b357", "value": 11966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349503, "uuid": "0dc27e30-fc1c-43ad-86c8-cdf775858d1f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349503, "uuid": "130cad11-2f36-4a96-9f9a-9e7160b8c992", "value": "felixReport.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af91185-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "75917aaf-e61a-4d00-b072-90fd6e05e1ea", "comment": "Malware payload (Vidar)", "value": "be2acfbdeb158112955f9ed2b68941c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "a8a8e176-e9d6-4f93-ba35-e1f5c2bd3242", "comment": "Malware payload (Vidar)", "value": "6e3aaf64e35db2811ea1edc83e88cb002d76bb2bb1691d1f0b8943f462aa31ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "d0ac9856-6c86-4ce1-b8ee-2a5ea037dedc", "comment": "Malware payload (Vidar)", "value": "8c1b111a25ddd1dc9a26ab2705e3f5478af47762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "e40d3463-c639-4408-8c54-d09bef8c3f91", "comment": "Malware payload (Vidar)", "value": "2c3392ba501d6c2fa77f700e413a2d0ffb799dc23fb6bdb8bd4839882ff3257abefc96199dca741a0dc22b8331a060ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "964ff24e-5560-49c5-aff2-f40e7f8919d8", "value": "T1DF82B541E11B99E4C4E5C333672E52A755FC7C2022356ABB5BDCA63A0D52370FBA02EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "9c0f3fca-6e1e-4c94-adfe-2ddf06720747", "value": "85b0aeb0d13fb5c7226c80e10830c4fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "7c090a3a-8f89-4060-a402-b1262118f242", "value": "384:aVCIp0FrUpIm4ZEBCLRNWWgMhCKZ/m/sxSlw:aUHisZEBCDG4+/Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368527, "uuid": "2bde73f7-ccbb-43ad-b856-38d5992aca72", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368527, "uuid": "f7cb1a66-325d-4511-afa0-124853cee2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "3cc3ee28-5753-4708-9a8d-2366785e4a91", "value": "6e3aaf64e35db2811ea1edc83e88cb002d76bb2bb1691d1f0b8943f462aa31ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24afa549-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "788f7923-050b-4b9a-8a2c-f54dfc24ef3e", "comment": "Malware payload (Vidar)", "value": "ede040251fbf14f67b57056f6f9980e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "a6294641-5c65-4769-9a21-b141c1532220", "comment": "Malware payload (Vidar)", "value": "6e80b575ef1deb11360fb4b8e336db460db9c0a013deefcd02a9b99a9bcd8572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "3277bc8e-c294-4022-b358-b1d60e23c2f2", "comment": "Malware payload (Vidar)", "value": "2b3cf71442d73f8a59eee0c865d87f96f03bb69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "d5dd8bf1-1193-4774-adbd-f6217bdb4db3", "comment": "Malware payload (Vidar)", "value": "60e74f819a835ee5aa495684bc7752a74e1520ceaf960a72bee06b94c94d0e159d9616fdcd5ebaa54e1d672ad05903d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "25c2f243-0995-4bc2-a140-9f3b68424d7e", "value": "T109827341E20B52E4C4FBC333A756512756F8BC052235AB3B5FE89B715E92730E6282ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "68df6423-00ae-4d14-880b-4b7a6d8e91b2", "value": "147d9559d7e86cc7d3c43b072d063583", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "c5380585-ae83-4aa6-b264-4c5bbf69a4c5", "value": "384:OIvopoiFmHSCuQZgyJs0u5mSq8absWVlR:LvqmyLQayQq8aBPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369269, "uuid": "e3dad73f-cda9-404b-b8c9-49156c514ab9", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369269, "uuid": "410851b8-1284-4d8f-82c0-5605ca2295b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "62bb5cee-c88c-40a5-9dc6-47a49bcc8fe8", "value": "6e80b575ef1deb11360fb4b8e336db460db9c0a013deefcd02a9b99a9bcd8572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0851417c-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1786373086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "1cfa6b1f-bd04-437d-aebb-81ecbf518fc4", "comment": "Malware payload (Rhadamanthys)", "value": "68855abb0d31bd2ff47a95a18ec255c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "b2bccd62-7a2d-4421-9061-168578ab0bd7", "comment": "Malware payload (Rhadamanthys)", "value": "6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "33183d3b-1855-413a-8ab5-9c9ae7cd03bd", "comment": "Malware payload (Rhadamanthys)", "value": "ef2ea8de20d62f06aae88341da12c1b35dd5cb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "846f171b-a912-48ed-b867-b449ac2a3c75", "comment": "Malware payload (Rhadamanthys)", "value": "37ead85240f15896458e360659fdf1ec0a709e2954677255c63d750ea0b3b67d88b64c6b2d1f5a3d8df0177fc308e8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "e1129cfb-e519-4da8-ac83-f51aeb575013", "value": "T13EF4CE06C7C266EDD64BE174C5228B0292B3BD205B01EFB6A1B9C795AE738CC1F75790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "2a71f00b-b309-4795-b601-b8023fdf621f", "value": "fed1bc871b298c8001a47718fafe9ff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "efd9f93e-c886-47b4-b470-83651a543940", "value": "12288:worUeSoB3z3BPdcogz5CDOaReJ7JjiPTmUqEztVkFbZVb5E5Vx+CcyFOmR6yl:wobSSxPdc5dC6GSUq0tOm5iCcyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373086, "uuid": "c5d4a15b-f24f-46aa-b982-166ad01bb160", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373086, "uuid": "d1c0e049-533e-4e69-b7c6-140b2228213d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "931a1b1d-f642-4671-b50b-f5a400971c57", "value": "6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c87c99f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "6a911910-93d0-46a3-9c44-824a6e1e3e83", "comment": "Malware payload (Formbook)", "value": "056590a3c9ed877064207e74dd8b8411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "40f976f6-faa8-418a-a862-6fa373c83c7a", "comment": "Malware payload (Formbook)", "value": "6e8536a9357f44f364359022cae1f4e6bca7737bfee92508a769dae863064cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "4e6cc6fe-2546-4632-a4ae-edcb0c87fdd2", "comment": "Malware payload (Formbook)", "value": "6339c68e739c87791fba8cd1b9f80ac08a01c7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "5e810969-4f8a-4f76-9ee8-25f296801120", "comment": "Malware payload (Formbook)", "value": "4ba072b22b517235ab53203b2011198e39d5dfc3ba3ac00720c1d0c0fb4fdb82565295a7265168ee2862c1a79a14c627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373281, "uuid": "df423e75-853a-47b3-bbc5-d4825d34328e", "value": "T17654238E6B22C373E27E3935CF494247E8A7A631B17A90337385F1DE531A9E075C5512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373281, "uuid": "38d318b2-f856-4136-827e-7f53fc5a0a58", "value": "6144:Anqp31RX1uZrLoDdt8VU0L23Vy8PG0WtWeAiYBcXsaXhzYlsnkK3:AqJXIZEL8WGN8w+qnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373281, "uuid": "62783032-4558-407e-b3ef-2bb97dd3804b", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373281, "uuid": "9b989f99-9105-45cb-8bd3-eaa0609bf9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373281, "uuid": "f27d3d6d-c49b-43ab-b06b-da4fe3c10e10", "value": "6e8536a9357f44f364359022cae1f4e6bca7737bfee92508a769dae863064cec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f224bae-9452-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786321612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "1d3de4bb-6a8a-41b7-9cdd-8c6c84dd0b49", "comment": "Malware payload (LxBaseRAT)", "value": "bf5be826908833f55e850ea0ba85d3e6", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "8689e2c1-f3d3-4109-9ba6-249476973896", "comment": "Malware payload (LxBaseRAT)", "value": "6eba72e816768b1c383487af637ddc3d64e5feacaed1bd7312b983bf28478ecd", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "59830477-e494-4932-a51c-ce35ea33ebea", "comment": "Malware payload (LxBaseRAT)", "value": "d67a15dd0a498dce033bb588377485aa038e545f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "116e42ff-c5d8-4fd6-98c2-8586fb615cfb", "comment": "Malware payload (LxBaseRAT)", "value": "956e21c8d2f6d21211739a6abd2bfec43224cc07c9cc1c4d49b6569d4616d796d90e46077029060b07eda7c278d407c6", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321612, "uuid": "b49359e6-1fe6-4ff2-ba2b-1fe0b86f31f4", "value": "T1C6C5F1383CFB501DE173FF716EE8799ADD9FBA33260A645A204503478B12A81EE5253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321612, "uuid": "3731ce6b-c616-4897-a5e7-199d01690f5e", "value": "24576:evzqEiCYdfvuxgDnn3/MAj351zcU/xj/irv7HthfzT6CM3:J2YdfWC/vcUVijv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786321612, "uuid": "b3d9ed0f-ebbb-4c3a-92a3-e1360d075165", "value": 2654720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786321612, "uuid": "4d7f084b-b2f7-4058-bc17-97bc3614253c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321612, "uuid": "6f50c411-138c-4ad1-bfd5-6599bce6db83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53bc11d-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "a6aa8d6e-0f7d-471b-8b72-0df8e162dae9", "comment": "Malware payload (Vidar)", "value": "925f9b5e1d7e7ffd66f3168dea250b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "98b1591c-0af2-47e5-a763-2faa8f0604ce", "comment": "Malware payload (Vidar)", "value": "6edb7369b387b29e443946e9696c3dba64087053cf844d637062116d1a44aa7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "698a4230-ec8f-4cb5-b349-fb2d7ad3db6e", "comment": "Malware payload (Vidar)", "value": "b55b6c18c2c04f16d50af24636af014c6a04342e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "96365f36-81f0-4c83-b1ac-dde302ad0393", "comment": "Malware payload (Vidar)", "value": "adf1844d500f8ae1ba37c224d16146c83234f1a91381facdce1d9af7b6f4482b8602bb318aabe150533f279db4869a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "2de81103-e952-4e37-8975-7a1405690096", "value": "T15B52068A71CBA0F9C1AC83B8DA9F03B7DA27341847255FBF61FC4660268331175E8A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "7f140daa-ede9-4b7b-8b54-fb6963eef014", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "0b53b272-d090-4c76-b89e-e470c2a5eef2", "value": "192:ODboPjEulL85SVuLk/1FVBTMnk+0wC5ih6GpSGxmD33Vje:OD0bEux85lq1FbQ3Ckh6WSYmD3lje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368196, "uuid": "52949243-10ba-4f71-aa43-867f6bcf5667", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368196, "uuid": "aa3f0f9b-6162-477d-ad8e-1d164c9a3e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "d8b3723e-6e71-410c-ad33-cea822e60b91", "value": "6edb7369b387b29e443946e9696c3dba64087053cf844d637062116d1a44aa7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c77956-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "1394cdae-4824-497c-a2d8-ac435284236c", "comment": "Malware payload (Formbook)", "value": "1c2dcd1954c559e812591517521f1d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "e71f713e-636c-4aa9-8526-1390e8df8122", "comment": "Malware payload (Formbook)", "value": "6ee6573152bfc2b0c309e67aa2c766766bb1c41a7f89155fdee2ccbec892caf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "5bf87233-a0a9-4e1f-a5c2-cfb3eed9a83f", "comment": "Malware payload (Formbook)", "value": "f66e461ab0a77babd58ae5f6bc2bb6b3d232f618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "3bdbf458-b6f8-4e50-8e4e-c7464a717512", "comment": "Malware payload (Formbook)", "value": "3eaa341b9b056c23f75bf0e93ef360807cf3fe5717a53a81ceb3430ed7a9a4559e47bccad57c4552954b4583633a6d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "913ba522-67b5-43ec-b1c8-17d6e0b3d2ee", "value": "T1CE25230C2D56E607C8651B7959B5F57912BD0EE9BC01E7278FEABEDFF9329088C80142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "ccd4186f-52a6-4ecb-a954-592a4a91cd2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "b1ad2ac7-18e1-4bb1-9c61-8279623bd285", "value": "24576:l2vmgkszvIJTvoh7Midyyt6Cqz3B5zzQWz:l22GIpQh7Pyy0Cqz3TXQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372007, "uuid": "9c0567a7-16a7-4cef-9841-6402231a06c3", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372007, "uuid": "99c5b8c1-78eb-4d05-a456-d291ff82e417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "400dec2e-73db-456d-b9ff-8a3af08f618e", "value": "6ee6573152bfc2b0c309e67aa2c766766bb1c41a7f89155fdee2ccbec892caf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaeabe58-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "72848d9f-865b-482a-afa3-7b26e08cbd56", "comment": "Malware payload (AgentTesla)", "value": "36012efe7e9b3d49b2cbf1bc05f624e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "c0bcee46-4413-4c17-a687-4621852f87ac", "comment": "Malware payload (AgentTesla)", "value": "6f33c793d1bb7673c300e9b87f7ffca6d17885ab3f92c5958f84e75faf1e884b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "60cf32f6-baf7-42d7-94cd-6ef716d032c0", "comment": "Malware payload (AgentTesla)", "value": "4bf24f059e0372f87552551d60cd1c5ae697847c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "0fbe6047-ae90-41a0-9472-bf3bee5f7845", "comment": "Malware payload (AgentTesla)", "value": "a3ba01237f2a92f8ac1b7572581ee165f1f47eef8e87ac10f3b5e51da37739bc7a5a1f0ee02d104713bbe7c96174fe65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "ceb85322-46b4-4c71-89af-cb86bed94745", "value": "T1F24402113386C96BC8525770EC6A89F74B10DEB4C677831B3742BDA979312C29F0D7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "033acffc-6933-4ef8-aae9-bc0b863c2b5e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "7848b2bf-0046-46a3-a606-0f639e61b595", "value": "6144:jB+pgU8O2WlqNhtWMZgfl0N8MzEOwQSx6NHByywzg9UqAr4F:jgUOxlCnW8g9vpT6NQg9mMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372930, "uuid": "16c474c9-513d-428e-b07c-c324388c422e", "value": 253840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372930, "uuid": "adfafeb4-aedc-4162-b9b6-ce933bcd9a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "6db06b6f-5f51-4f91-b61b-cc809b37ddc0", "value": "6f33c793d1bb7673c300e9b87f7ffca6d17885ab3f92c5958f84e75faf1e884b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec574a0-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "391382ea-3a18-424c-a24b-3bca382febba", "comment": "Malware payload (Formbook)", "value": "4f2f418d29102aff7386f04fc8db98e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "62b4faf8-3744-465e-b3be-fb466f8333b3", "comment": "Malware payload (Formbook)", "value": "6fad973fdb78b0658af1f962ef1d000631e36bfa34d0c83d0632759805e72852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "d6866256-1f60-4102-81e9-da84d2d5abf8", "comment": "Malware payload (Formbook)", "value": "51a6f297c2984963ded31f38a87ad3439f58088f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "7439bc7e-46ce-4c8c-be82-ab233ced583a", "comment": "Malware payload (Formbook)", "value": "7eb9ba2fd7a1bcb6fdbcc1619c212c39aa250e8308e593874d5002ef8078ba72bd3897908f86f1d060cbee4357d45001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "1f2a33bd-11ed-4f34-90f6-cb6a460e0ca6", "value": "T1034501486798CD06C46A1774A4B4D2B80B79AE59F911E3031FC9BEFFB9773225C09287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "2c5435f8-3550-4cfd-93e2-8185f310055f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "44d93f96-3bb6-4d12-a626-e7df0aab99f8", "value": "24576:WAJvV0LWmlFOZxQwyMpfVIFMz9iDlvzAfWD7Tchn3j:WAJN0LWpZT3R47T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369527, "uuid": "c03c3dd0-2e21-437a-92a6-58c965155b3d", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369527, "uuid": "9da904f5-751a-4539-90e4-df2fd17d739a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "82eaede2-8b13-4176-ac92-637e2d91747a", "value": "6fad973fdb78b0658af1f962ef1d000631e36bfa34d0c83d0632759805e72852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d772d1d-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "ea1e0077-7641-49dd-98fe-6370e89b85fc", "comment": "Malware payload (Mirai)", "value": "3bb6cd6fda610f65fd05741e20306f59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "c6c10e0e-082b-48a3-b5fb-1819bdabb51b", "comment": "Malware payload (Mirai)", "value": "6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "0573ac74-8424-440a-94da-4332cc213384", "comment": "Malware payload (Mirai)", "value": "2fa81859fc4ff50f43ff16f5cee544f6e84cf5af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "9a491184-c6c9-4258-833f-9473ba30fdb0", "comment": "Malware payload (Mirai)", "value": "9a90052a5641fcca01cb763c044b1633dfadba91afc7d952a3744287d6d88ee4d635165ab79be7407de6debccff6e881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340051, "uuid": "3e95ce41-81db-407d-ace2-5b89360331b7", "value": "T1A0840B88B5F2E2CAD1D4EAB5E319784D3B634336B1D73145A50EEA3312EF14909BDE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340051, "uuid": "f7380cda-adc4-4881-8a00-4c44eb33fe95", "value": "6144:qhlQa9bNuO3r0eyQg5mBWwcPMxwQuEQjV0HI9c4BoLisRJB9:qhlQa9bNjhBfcjQ/QB0ydOLisRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340051, "uuid": "ca45bf06-396e-4ebb-9147-101b3fee7595", "value": 386272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340051, "uuid": "e2cc68fa-6bf0-4183-aff1-c00f11db2154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340051, "uuid": "c25eb3ae-aba8-46de-8c0b-8daed48f57c5", "value": "vlxx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce332be5-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "432a1dfc-a8a4-46ad-911b-6d78479a5850", "comment": "Malware payload (Formbook)", "value": "e7d0e9075b3173c1dd62bc1ebd7902f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "fc08bdf4-bf62-49d1-bd49-e88ae4b27439", "comment": "Malware payload (Formbook)", "value": "6fca0da799cc63ba982f310d9c0b5e7f4d19e5c4a48fa9abdc60bef6ee0af0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "7604e030-dd9e-4d16-977f-990f11eeb47d", "comment": "Malware payload (Formbook)", "value": "97155fcf0b8034dfa2fbbab67929f9028f88ad32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "ae487a3f-c67e-47bb-836e-ec931949be45", "comment": "Malware payload (Formbook)", "value": "3938bcd2f6595781d0cf5ac70b22172ac1acc31cc68c0c0d8fb2bc7f2ab11b8a5eecdd15df4b9325f634f7f2383cd253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "0e1fec56-b937-4d00-8c8f-b59406f94aad", "value": "T1DD2523686A0BCD22D9C60BB208B0F7BC46B59DC9D604D3578EFCBED774287067C28995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "e7615a3f-2292-43bc-8696-d54082c25f8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "ccd7187d-c2cb-4b2e-a437-860152d102a1", "value": "24576:q/gqGhF6d45HvlmXzRiD0AlLF4Rg8Vl256Z:q/gDK25HtmjR6FF4u8VkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370841, "uuid": "746ab94d-ce0f-4c0f-9b2d-3329e9e1b5ff", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370841, "uuid": "0794cb4b-bbb0-4890-860d-cfa046d71353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "78b3c9bd-f6ca-4726-85f1-c7d887f963cf", "value": "6fca0da799cc63ba982f310d9c0b5e7f4d19e5c4a48fa9abdc60bef6ee0af0c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8ccad5-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786368481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "39e59e6b-4e79-4f13-85fe-e8ed0d3b4226", "comment": "Malware payload (XWorm)", "value": "9111e904b37905a4950371178fe573fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "6ffd7e79-0437-492b-9493-f0aea147a08b", "comment": "Malware payload (XWorm)", "value": "713a11326d11d660cca496d6a944416e9b990eddb9156f8435dbec0a91bf56d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "b4871fb3-3b14-4155-ba59-cb5c02114e84", "comment": "Malware payload (XWorm)", "value": "207b26f60b4c2e08bafbc1376593e08bcd24fbe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "430a0788-b6c7-4f9d-826a-1c5e7baf9ca3", "comment": "Malware payload (XWorm)", "value": "77a307ea4cdbc0bd7628324cb1a680aa7e58efe8eb6c865700551b2340245231685f8600db9045c3c327ff848bef6024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "41373fa5-c13c-41e7-9fab-5f96cc83d8d4", "value": "T14A05E0C037397B05ED741A319A75EDB582B92D69B020F9EA1EC93BDB796D2005E08F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "057630cf-86bb-4886-8530-a9f5bf2a7dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "62ad44e6-af35-43dc-af9b-59b356fdf65d", "value": "12288:o/PNkwCjLnDCLoeXfaN6er078i+lYjzhJzD8fGhOSCGtvNQaldEzPYd5wi5F:0kdjLDCLFCNZI8iJjzGwLVBld6iwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368481, "uuid": "d8ee03e0-8d1e-47eb-9e04-75a1f78aca65", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368481, "uuid": "50334998-4293-4768-b521-db771bef8b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "b2c8bd08-b69e-482f-b6ec-422326e8938d", "value": "713a11326d11d660cca496d6a944416e9b990eddb9156f8435dbec0a91bf56d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329ec459-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "8befb497-e68f-4db1-82d8-9c4148abe50c", "comment": "Malware payload (Mirai)", "value": "9acb39fb86f76ddc4872b653b3767029", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "97f5911a-ba31-4ca3-ae8e-09d86c559276", "comment": "Malware payload (Mirai)", "value": "714d96848961e1168accac6cb5c2965646449884061021d5665efc59dcdb0a89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "55e7705b-d0de-436e-baf7-3cba19916781", "comment": "Malware payload (Mirai)", "value": "5c14842e1654e1455034b381e022002b0271efa4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "89032c2d-a34a-47fa-b8b9-529d8e60f011", "comment": "Malware payload (Mirai)", "value": "485e96b0482ed3395a9e40b33000bd8b9df7a709cb0b527d28e85be236dbc8d7ce5424a5f13d9c494856c0b16608e7c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "5adf7716-7503-4ca2-a06f-6e2c2e1a5d45", "value": "T1AD142945FC419B12C6C712BBFBAE428D372A17B8D3EE31039D215F25378A95B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "6c88effc-39fb-44f1-8da4-f4fa079db61d", "value": "3072:jj4gubVgcIlIjOhYYSaEZnAR/De8yaLVEHxalYHtI9P:jj49gcUEa6nARS8ya2RauHm9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356837, "uuid": "a39ee524-daf9-499e-8a4d-7907ad726bb3", "value": 195128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356837, "uuid": "808b21f4-f668-4a98-b15b-0e878a554021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "d71307f3-3ef2-48d9-aac8-e5698170da40", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6101c3ce-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786374094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "6169c53c-6c20-4cd0-afae-e486ded7e28c", "comment": "Malware payload (RemcosRAT)", "value": "83b3aeb0e8002a05de9a8bba1375ae25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "13559ea6-770a-42b7-be61-269735203948", "comment": "Malware payload (RemcosRAT)", "value": "71561773c4244f38432d45d581f970c80a7e334ea0a18b8f9b575f9a1951e3a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "3fb5a703-fee7-4213-a32c-c7adb72696c1", "comment": "Malware payload (RemcosRAT)", "value": "967b28b7cc9728c1502880b295ae5e57aaa66733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "2a317915-c583-44b9-b0c3-e62ebc9c36f6", "comment": "Malware payload (RemcosRAT)", "value": "cb00f68dbe726e271e9e286132a7e868d21eaf670d60c2f79420db11d8bec99b1981003eec370de7e6ecddf1179459ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "86e3e72f-420f-4fa2-9d09-4ef7720cda47", "value": "T1ED6512486516D612C9E547B806B6E7B8173C5EEAE400E703AFDDBEFB353AB055C042A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "027e609f-b776-4f40-95ce-2de8a9e6183f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "9f23d09c-0c08-4fdf-9d68-31cda4de234b", "value": "24576:TeA9s3oiYueS37eqAvjVOccnAPwINj7hhnZ0g5EKUaDU8bDb92w1I9txng3ITCLp:aUs3KDs7rcWnIt7hF2g5LdUyb92RHxWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374094, "uuid": "2d0c6abd-3e9a-4216-8076-2b2c00287e99", "value": 1420288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374094, "uuid": "32edd20a-650f-4a52-a328-032d8ad7c4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "745e10b5-84b0-45e7-a770-71d914838ac7", "value": "71561773c4244f38432d45d581f970c80a7e334ea0a18b8f9b575f9a1951e3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bea67f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "e170b885-44ba-4855-85ad-8435cdca3c60", "comment": "Malware payload (Vidar)", "value": "bd2173f942f0faf30b1b60aeb9c943bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "9d5f1ed8-4b47-47d0-a2a2-26696dae2de6", "comment": "Malware payload (Vidar)", "value": "716cd4fc526b6baeff871d36fe91d282edd2699a4d188c6d6b179670a109fcc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "d74146e1-8b01-4130-9780-82f327d64467", "comment": "Malware payload (Vidar)", "value": "143d9d4d447281db7dc1b787779f145746aef87e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "9a5be128-1854-42cb-a674-d4676b20452b", "comment": "Malware payload (Vidar)", "value": "13c35fc2c06e3a6e119663ba79e9b3a098677b209c3f406a6adeb1a1abbbf4aaec5b1ad3fd7cfba8d561b61e2c25bfd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "24bd49ef-7e3d-4595-ad4a-9ea8a2e0dbcf", "value": "T10152F88AB0D7A0E5D1A6C238D60A1AF7D635705707395FBF47CCC2947BE02502BE9E88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "48cee2d9-603f-44ac-a554-8f958ecaf68d", "value": "906e7e2a0725f22826a1dd411058d58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "ac137198-43cc-4831-9f08-74e88d60f3e3", "value": "192:OSur73ZI4KjmDcV4IzCG+evqcpFcRG9UuoSh0om6YhtH7hzv3V:OSur764KqcJWEqUinShVm6Gttl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369131, "uuid": "46737d12-8a99-4b0b-a6ea-cb960f724506", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369131, "uuid": "b37d2fb8-fa83-495b-bd5b-e8e5cc22e8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "f98b6fd9-a2e8-44e3-b313-de36e6020530", "value": "716cd4fc526b6baeff871d36fe91d282edd2699a4d188c6d6b179670a109fcc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f2b44c-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "be94da87-7876-4c4b-a31b-7b84f19c3031", "comment": "Malware payload (AgentTesla)", "value": "af63ab0884c3faea791036c5801ff311", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "acd5dbba-1073-4ee5-9e3f-06d25cb5e1a4", "comment": "Malware payload (AgentTesla)", "value": "71ab6ac53c0af815f043a04b31d779964acbe64c4a79cc0309ae8c8840c1a7c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "c735baef-af61-4f01-a623-bdb3ba876349", "comment": "Malware payload (AgentTesla)", "value": "1414d100818f6a08cf7ab4b7d96727aa4caf1ce1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "dab76590-ea91-4a30-8dc5-98c410a45f1b", "comment": "Malware payload (AgentTesla)", "value": "c787c81aeb030b73d63f89050eb9a81035729c7926a0e0c306b2196b8ee87612803dcfcb7ff8ff3f933aafaad45cba73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "05f6a2d6-503b-4827-abd5-c85fe8ba0755", "value": "T14B45CFAC3610F59FC857C9768E64ED74AA142CAB9307D20395E71DEFB90DA87CE041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "ff7530a2-5c5a-46ac-8514-42f7f0525456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "ec97d41f-2648-4d6f-8035-c25e53f1e2d3", "value": "24576:iJieA9sEkO5GOQBV9iZ7lG2BF7S2zg8yVcg73CJULWl:iUsE/QLHw7lG2X7gOGLWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374042, "uuid": "ba7cc3e2-ea58-4574-925e-4eca5e719507", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374042, "uuid": "dda1a4fd-00c9-4c7c-bee0-3c8b448eedfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "0fae74a9-90fe-4bd5-8dbb-6245fd650ee5", "value": "71ab6ac53c0af815f043a04b31d779964acbe64c4a79cc0309ae8c8840c1a7c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883e8b36-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786345813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "4f1f4dfe-4948-4e86-bed4-c9b8720174f7", "comment": "Malware payload (RemcosRAT)", "value": "480b14ad50a0ecd80e6178c07461d1d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "3418c711-34c2-4737-9557-5b998ae36958", "comment": "Malware payload (RemcosRAT)", "value": "71bbe25652524477008004b568cb32d3ed5c07693c763fc7ae673060a2e04d1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "8b059290-521d-4646-a8cd-bb21adb4e8ea", "comment": "Malware payload (RemcosRAT)", "value": "02678dbd32a5f23437e39677f0f3ac6a227240d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "d63379ae-72c3-49d4-8632-8231acac5f03", "comment": "Malware payload (RemcosRAT)", "value": "39b4e66d51f4d1349b80a9ae2076992d90b85633b809f610e4cd076098433c0a40508a9dc1985cce7cc3aa0961df80e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345813, "uuid": "acdcd18c-d489-422c-a387-0ac6071572c4", "value": "T19573A09B291669FFA8578A648700872CEB098701143334EE5F56ACEDC3F4DE740DA9B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345813, "uuid": "80331ee9-0f3f-4238-8f1c-5481abbf62b9", "value": "1536:4E7ytzsydodx6WHEOY4Xvh6cSbKhhS48aqiz99fX3zhyqhlon5gRsrcl/m:4E2tzsydodx6WHEOY4Xvh6cSuhhS48aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345813, "uuid": "c9792148-4d3f-4189-80ed-3dad8785f9c7", "value": 80204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345813, "uuid": "27c0b9d0-56c9-4f0e-900c-84c7de79a459", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345813, "uuid": "132754a4-fa43-4566-a3dc-79684107bf4c", "value": "INV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd5ef16-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "7ec6c356-0b10-4d8e-802c-c5dea1dad239", "comment": "Malware payload (Mirai)", "value": "b0c5e7b4246bba3e1bbc8aa370032aa8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "454bb3bc-188f-472e-a2a1-23603bb58401", "comment": "Malware payload (Mirai)", "value": "71bfd2feeb5a28e09905f136114758abd087bc28d813b47800a1f3cc0b6c178b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "500f676f-d97a-4507-bef1-e211f06198af", "comment": "Malware payload (Mirai)", "value": "3d2f7285f62735ad7e7f9a4d92c457b144e3ce9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "7a43cd65-ed03-4130-ad60-be4a71c0f22f", "comment": "Malware payload (Mirai)", "value": "a7ecaac6a0473fd4519be2d324e383f340b7353756f756f42d93e6242d2794c0796459031c39a8e4188305203c65b9c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "049fc064-0789-4e78-a521-3a5e5a37a014", "value": "T167A3122D35109AA2F401C7F8621603B6DA3E18E6F737FD4A85B5AB171AC406D3E2F694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "c77bc95c-e1c6-45e7-97af-3159d8201a6e", "value": "3072:QVFUXqSN0SJkUkcKFrjGdEVPNYKuGzi/tm8xZVEz:yK3JxkHFvGdGYKuGiA8tEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383591, "uuid": "0c8f5dcc-599e-4137-b84e-02313b9b0389", "value": 106596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383591, "uuid": "e231ffbf-bf50-497f-b9ec-fade1ff9b8aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "73a029ed-6147-4213-9f35-ebc88815762d", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472453cf-94e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786384359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "d03e4ed0-a72f-4fb6-8669-8780d9514a3a", "comment": "Malware payload (RemusStealer)", "value": "ac83d11119f58ce7fbdbe25f70476d3b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "1cc214f4-918a-44f9-9844-c1e4cbddbd10", "comment": "Malware payload (RemusStealer)", "value": "721e28946f79f65e9722d27fdb6fb384a3fb747c82b4c8c2f9dffc0fdc6c0a49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "bd3b991a-e43a-4235-b52d-8a3289ca64b5", "comment": "Malware payload (RemusStealer)", "value": "b16decc10a8ee1e9aeddb7ab9015b8d2665bd3ba", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "d436fdc7-98c1-4323-83dc-564a025387d4", "comment": "Malware payload (RemusStealer)", "value": "ec2c73caa8a270749de1c2fc499ba4461132ab4b8532ec913c3784e571f256aadba888bfcc85697f283b79120385c57a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "a14de3e0-744e-4c43-9ca1-2360762e3e6d", "value": "T185C65B03BDA149F9C0A5A73188B76252B770B8485B3633D72E90BB782FB23D06D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "5a61ed9b-9761-4e12-b5b9-a98da5998c78", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "f1b291e9-29f4-4280-a61b-ccaebc4c7ab0", "value": "24576:ggEpkrG06peGzdiqNFacnNdc/USzyPXg8ydHJcyqfMMddYv/oBele5I92ri7tKNn:ggEp0Z6H5icFvNdc5zyfg8qqfMMMIXLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384359, "uuid": "257b2dc1-4fe8-4970-a8d3-4a4552e5470b", "value": 11879272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384359, "uuid": "cae38d59-022b-4fb7-9a24-9e9268d26c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "8773680e-13cf-4877-82f6-23291274f54f", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f20cfe-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "5f82acde-8052-449c-8d37-3365ca7b8384", "comment": "Malware payload (Vidar)", "value": "62f2363ed147ffd280bd9e24bda2a862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "46a11cd0-e322-4049-ba15-13cb56b114f8", "comment": "Malware payload (Vidar)", "value": "7223093aa99713197e3e669794d2971953d75e11703b58e359f1946bf1c4e197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "8513956b-fea8-43ed-b8b8-1861343d6fe9", "comment": "Malware payload (Vidar)", "value": "51b1d6084925760d07d4fe33f19a4f5cdf38c895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "cb29df0c-f888-42a4-aa58-f455849d8349", "comment": "Malware payload (Vidar)", "value": "7e82e2557c7799d65726d2849caad46128f17f897123413700eee975465504b518f17873b122c0bf2c7e7b0634d13d84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "9473b365-56e8-419c-a1f9-af70bc399413", "value": "T19E520BCBB1A2B0FDD4EC9239C69F12E3D625308417161EFF96D8999537C369038BCA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "6a8cb798-4a51-4c5c-aadd-5cb771dacf79", "value": "383dd58795248eb99a4152fc6e9be0d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "e2a15b14-fa1d-40c5-af71-9a520221705b", "value": "384:BQCeo0EcaThu+Mp1XVwAub0GgcnhwH6lwg:BQY0DqpeXOAuwShjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371276, "uuid": "d25d565a-59d7-4eec-be5a-3f971be457d6", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371276, "uuid": "0fb91175-3f90-4ebc-bd93-2c7eb2f6e52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "60b89b58-625b-4fdd-8763-a74434a67f90", "value": "7223093aa99713197e3e669794d2971953d75e11703b58e359f1946bf1c4e197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760ee906-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "43ea7aa9-d0ed-477f-acbf-83b1f4baa1c3", "comment": "Malware payload (Formbook)", "value": "d81411ab7d730c4db3bf5d53f7921220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "9020ff5e-6b5f-4085-808c-d2fbcdb8825c", "comment": "Malware payload (Formbook)", "value": "727a57b900d1a2c8ad8100fe1eda2f0fd4ff0b15297911293b80b396e5c1ea7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "cb09bf7b-0aad-463c-a10c-e086e1fadf2b", "comment": "Malware payload (Formbook)", "value": "0858bc368f27606bac67fe340d02bccae9fb216e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "ba50236e-7be3-41fc-9172-4112312b3d07", "comment": "Malware payload (Formbook)", "value": "6ce1316e468a93bf72e5484c72ca271a346e74bf92e8b092b705da46a49d979daf96109a59314625163c7e92b1116fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "14b3c4f1-af5b-460f-b428-b0e1fcf73196", "value": "T16835235573A18B02F8AA6FF90AA2F670477AAC8D9550C70A7EE97DDBBD373042401353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "2f5e036f-0a52-466c-a977-1d8a0abd97e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "65ad5800-8d6a-4810-b0a2-68debcdffe6b", "value": "24576:bzRtpAiofswxbj3wIE2qFGN7JmTuW/FeZ:bzTphwVA32DmiW/Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373700, "uuid": "b0fd4415-bd18-46f3-a0cb-ac24d3dcb590", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373700, "uuid": "05a21528-2545-4f7e-b3da-80f3cb65cbc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "2edb2581-f056-4504-b03f-76ee21f522c7", "value": "727a57b900d1a2c8ad8100fe1eda2f0fd4ff0b15297911293b80b396e5c1ea7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cfecd3-94f5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786391792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "7e1c1941-0468-45f4-b257-192d05aad956", "comment": "Malware payload", "value": "6126efe8426a19f83253a9cef7985652", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "18b5e56a-7c08-448a-9565-512415d5e3cf", "comment": "Malware payload", "value": "7280994fe542c284d3ee4c42b4eb5a7b07eb5efc6c8bdce66d5f8ca0316efe5c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "0f1c011d-17ac-4f50-9dfa-1da0c93a5559", "comment": "Malware payload", "value": "f99f46b88a6f9ba75e7d0999032935d15552a3ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "060e34f7-4609-4213-b398-d20f49b44cb6", "comment": "Malware payload", "value": "397576ee8f149a33724674e89208a876d3214e25a714975825804919d76dbafcb2f3aacedda3da104928271c9b2a52a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391792, "uuid": "a23038ba-a57b-43ee-9031-0499ac38ab97", "value": "T1B4C28D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391792, "uuid": "2a65fa5c-a76b-4c92-93d8-0e2498a5d63d", "value": "768:Y8vCB+25j6es8Rd9FYpMSUpi+20qUpi+20YQX:Y8l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391792, "uuid": "52392e78-fc1e-4f42-b2a5-f4d8d130ec38", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391792, "uuid": "92ae3a52-a46c-448a-923f-8b65b40ee72e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391792, "uuid": "7bdec1a4-4c97-4c93-abf8-734b97498143", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304d5771-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "db0992f6-9a16-4d7f-9c12-96fafee5043b", "comment": "Malware payload (Vidar)", "value": "ef63a093f223bfa4b0e80f7f788914d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "8c7b3742-6bd4-4f1a-a189-961cb9e77bbc", "comment": "Malware payload (Vidar)", "value": "732cf4f36add7be33afaeac48a7c9ae58dca0575b153a983946c3d308ea1fa45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "8227e442-876c-46ea-8767-c905208373fc", "comment": "Malware payload (Vidar)", "value": "b080792920ca1beafb37e24949ce027214512592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "adb30c6c-ebcc-4652-a948-44d7e5c0fa17", "comment": "Malware payload (Vidar)", "value": "c6659f092eca2041fe7d5f89d73df060b3ade402f217efe248913200b6918cb3563530498d3c03b5a1ec3abbf832f710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "fde14185-a134-4cec-be50-59422e0767c3", "value": "T1E6923F42E15B52B4C4EBD333976A416726F8BD4122369B3B6FEC9A250D42330F7182ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "75d06c36-b9b8-473c-86c5-e61a328393d4", "value": "ec587b6acca52217c3b4bdb530ca22e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "33ab2ea7-080b-4348-9243-a0cadf7c293a", "value": "384:OA94pfSj7v02PCPL/XcPwoTTmZS6g54WEwZF0lR9h9alX:z4j2PmfYmZYfGn390X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369288, "uuid": "0515d7a0-95f8-4563-8b79-9dd0a32666ea", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369288, "uuid": "c9e64a63-5ab4-472f-8763-4a945d36d84c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "fedf999d-fddc-49d8-abab-ff801075e3ca", "value": "732cf4f36add7be33afaeac48a7c9ae58dca0575b153a983946c3d308ea1fa45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f72100a-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "d722fa08-476c-4e25-9ea0-7e79255dc2e1", "comment": "Malware payload (Formbook)", "value": "069eda39e383c1958d0f0a3817e0e777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "30493b6c-9e0c-4921-876a-1197687bf28c", "comment": "Malware payload (Formbook)", "value": "735e61a90cca4a8e265b040b6ed86bc34cd5d298b6d5f9d2fe68dd6aa85b5113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "84255536-8741-4a67-a2cd-a0348cbe7edf", "comment": "Malware payload (Formbook)", "value": "f2233fabc3fa7e2aa388a6fde456fb4e456d5a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "583f536a-6e38-43e6-961f-9d6633c981bc", "comment": "Malware payload (Formbook)", "value": "3f0a4ec8714aec1d85a4e8adcec89317001aae78fa56a8b35e1f3d58599a1bc027840d2e949d108b502d8804fa1bcf1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "d3fde46d-ba73-4df9-ac5e-a22f48afe981", "value": "T1E43501242617E802D5D58B77E9A0D37433641ECFB9D3C3966FE96FB7381B3865890282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "1db287cf-21fe-4e56-a28d-391cb735053d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "c2090d45-8d5b-4578-8d48-32bd0fdc83cb", "value": "12288:+Dxxltnn0gxo954ZJSJOlw8n5sJgOFpXpeXOer6p6OIyMWuIb8pRZga4n9KBpdgm:Mp50EqL8158Xle+er6CW7C312ry3TBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372723, "uuid": "203c3334-3d8f-41a9-903b-b5a6f42f76bf", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372723, "uuid": "be93e792-0640-49d7-944f-98eac85c1e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "5b87d7f4-a406-4b3b-ab73-8d61edbace8c", "value": "735e61a90cca4a8e265b040b6ed86bc34cd5d298b6d5f9d2fe68dd6aa85b5113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508f5700-94b2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786362900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "ef083302-bd15-47ea-81b5-4f64e4f3bee9", "comment": "Malware payload", "value": "7a78946f79afeddcd44f198e6d38ddcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "7a6d2709-8c68-4667-a3fe-42ef22dcf24f", "comment": "Malware payload", "value": "73a914cd8e191f234bece7f1e7ad6e82a00388fa8828d94e1a53c8b60e7591d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "f2bf04a3-bec9-4706-b7ea-4fcf96ed7350", "comment": "Malware payload", "value": "8574d0703be69313549983658ca0110df96f437d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "fa72e576-bd61-4fa8-896e-d61e0352e251", "comment": "Malware payload", "value": "6b9d6b489f3c151e3e6a4ab428b7b691336f8128b4a60db9e65811c933cc55fbdec8fdd832e440d224da397b1520205d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362900, "uuid": "600c30d6-4233-4a4a-84d2-df7b63bc42a7", "value": "T17A353466F2DE0302AE7C3465DC1F26E7D67B010DBEC58DA8BDAA8C81965006D2C19D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362900, "uuid": "45291f87-7e89-4893-b41d-3ba0b63da822", "value": "192:08pc4BV46t4V4f4B8Ds46t4HHV4itc464V46gqttDtDW43IDg84V464IDtibqgRV:HkxdYqAmP6yi9t/hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786362900, "uuid": "b92c2644-d275-4090-9cbd-5d20f60ba4e2", "value": 1115280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786362900, "uuid": "6b9c71dd-58c9-42e3-a169-b831034bcfb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362900, "uuid": "8c3ad1f0-d025-4c23-8ebc-cf967ae07dbb", "value": "pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75796580-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "9849af7c-189f-4d42-887d-96bc965fc2ef", "comment": "Malware payload (Formbook)", "value": "1c23c8ad57e1e72f4797181d9d94850e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "21368228-2449-46a6-9fa0-e204fc99d769", "comment": "Malware payload (Formbook)", "value": "73af5029cf043e0c81ebe7258426cfce81c530a92afa74858a978faf2834047c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "67a593eb-2f71-48eb-9bf9-267885a9d95e", "comment": "Malware payload (Formbook)", "value": "a6dba20a6a0fec16f34a364ff0fe570292cc385b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "de470a95-9237-48f7-b2ff-eb0da02a2a3b", "comment": "Malware payload (Formbook)", "value": "9aea01421eb01fd1f189f675a04c5eb8068dcb95c502282bd0644e476e7537b565cd4d6ad286f055faacf19bae9a6c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "910d7f4a-0983-4727-9aec-1dc62b844f43", "value": "T1E625129462A8CB26E8BA43F15AB1E33047B47D5B7626D31D8FEDDCEB3861B410A14353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "016d2e00-fd05-4826-a9f1-23a1f68af33f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "5dc1f552-e276-48c6-9563-7aae333f7329", "value": "24576:lECJAB7Z9LZCGhwbD3enYGYqiOz5PFqz2fQ4:OCJABPkGSRFq5PYIQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369404, "uuid": "06d3d1ed-08d8-46b4-b7a3-e021812b8489", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369404, "uuid": "790b64c8-eb33-4222-8b08-819ae7ed3de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "9d636ac5-642a-407e-9328-c823ba2c5823", "value": "73af5029cf043e0c81ebe7258426cfce81c530a92afa74858a978faf2834047c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9156c4c-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786370913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "be8f019d-e6a8-478b-87e0-9f297972b4d3", "comment": "Malware payload (PureLogsStealer)", "value": "afb9ab48d2081053f575c484a43ee453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "93b9124d-fd42-4ee8-ad04-7762bd1eb341", "comment": "Malware payload (PureLogsStealer)", "value": "73d160235a304ea24fb35c50148512d94c30efd7e701b0fa06323acac4e5f5d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "841340ce-2010-4ca5-9686-36be9bf4dd5f", "comment": "Malware payload (PureLogsStealer)", "value": "5512f576ef3889ddd25b9327b1aebd87776ff017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "3f1b9e54-c6f1-4cce-a9bf-cf0a3f1bdc00", "comment": "Malware payload (PureLogsStealer)", "value": "eea271369f41026ac10852f11d7738c7aa27715609fa6240be8f8e8ee3178bedc2aef48ee3beb87f0ba642cfd094a7f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "81b17335-3be8-4f46-b7e1-030c68f15ae3", "value": "T13A85E119F29922ECE527C274CBA16632D6B6780607A0B9DF0699D3151F73EE06B3F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "18c5f8c0-220a-49a6-ba39-a3b6088301c8", "value": "77bff2418e99f39a0b3cd60b9e0c1e64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "fb9eb5c4-ca6a-483c-ab64-88ee5b1f4ac6", "value": "24576:y+nwWo9aWFq3jQ8nrbM1UHm1TUMuFi9Xkt5ZJiBbOZLklBNkHQtdrMFLAXCK1/c:y+nwWiH4jQPUMugX4udrQLASKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370913, "uuid": "1b3919ab-c2ab-42ce-b681-fb0b37b992a1", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370913, "uuid": "0f9b872c-7555-4f4a-93b5-70e703d7128b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "64cac964-3c8f-4f7f-b367-7fbc475b8472", "value": "73d160235a304ea24fb35c50148512d94c30efd7e701b0fa06323acac4e5f5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbb80a4-948e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "5a56c244-62dd-4842-8d4d-6345cae3b58e", "comment": "Malware payload (Mirai)", "value": "a713d24fa20d1af180b7778aff617cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "1658ef80-f709-455d-aeac-123fb03825ce", "comment": "Malware payload (Mirai)", "value": "73e3159ac2b6f55c2528734df1c7eee06bf68b41ebdd66e00beef77243ee644d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "78c7f738-43eb-4c26-8839-d027df748a54", "comment": "Malware payload (Mirai)", "value": "94174acd25997935cd98147fcb6aa32e58fc8b1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "72a3286d-453d-48cb-bc29-3ca449342542", "comment": "Malware payload (Mirai)", "value": "bdab235872541dc6fe358ef418b6b35190119d05b63fbe91201f4cc20f15fdba7cc442d1a452a741e28fd12b15ab1113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347353, "uuid": "e29a1034-fbce-40ad-b6ac-1623a9caebf7", "value": "T1E1A3C84AAFA11EBBD81BDD3705AC0B0234CCA60771583B767574D928F64B54B8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347353, "uuid": "fe71fa65-8695-4b57-8075-06f94da859ce", "value": "1536:RAIu+CSgmb9QfRIQxmoLI2QJfMcKtLRu5BqZD5npHQgsllSp0g:jV9QfKQxRLTQRWHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347353, "uuid": "d91f511e-a551-494e-9b55-2ed452fe6299", "value": 103504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347353, "uuid": "762df302-186a-4c1c-9c53-1627a960a6dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347353, "uuid": "70c82843-bc50-4f68-88b3-42a2f4a74de2", "value": "cCf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8ba872-9473-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "2a8ccaa4-efd7-4362-ad3e-205152d4e538", "comment": "Malware payload", "value": "fd4a298e8e9f5f5de74fb44e91b4a22b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "8fa16cc8-e7a0-4965-8df5-060d5f31ae78", "comment": "Malware payload", "value": "740aeea5b11d71914ecabc889848ac1feeaeab299dc22a9fcaa222fe09947150", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "0a1f3ec9-e0a2-4889-9133-ec7779fa020c", "comment": "Malware payload", "value": "282fc1cab93fa3c6cf0596bf640a2a9d92557593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "8d0c9a77-dfe6-4759-89a9-dda32c34be5a", "comment": "Malware payload", "value": "c09620e47dbb4811ed28c49cb3251dd1650894e86882a61961e10219dbbeaa204d1ab6d18134a80ce994e8df6de158e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335806, "uuid": "51e3b3d7-f737-4164-974c-29ff1969efe8", "value": "T10F231941FA53C1B0E19392F008A7C7EA9234DE37505BE6EAEB8D3921FC317418D9666D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335806, "uuid": "72577a30-808d-404f-a208-dc45c49a34af", "value": "768:MmTLC6Fniqy+TE4zS5Q7GMRAgE6BzcEGtlxXPyRSSgbmcJ:nTL7FniHSvS5Q76gJEtYRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335806, "uuid": "c7de0448-74c4-47ef-91f3-f733c1a41526", "value": 45864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335806, "uuid": "e2ea36f8-c07d-4c43-ae12-7df114261e3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335806, "uuid": "a616d316-110d-4286-b094-41f0bed73b0d", "value": "740aeea5b11d71914ecabc889848ac1feeaeab299dc22a9fcaa222fe09947150.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bc706c-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "4eab0d2e-c394-4e27-98ae-bb5114dcaf9b", "comment": "Malware payload (Mirai)", "value": "7ef8790cb62f5b52197679c7e4fad9f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "c10190f9-2252-4042-a37c-088546c353ee", "comment": "Malware payload (Mirai)", "value": "742cb99b675080e6eb3b19393aeb9d6d7003233ff8756f052ef119291ad10d3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "c1338cdd-0639-4f8d-bdec-3c5f7a934d7a", "comment": "Malware payload (Mirai)", "value": "9de0f3b8c9e06d3cbdc335e001751729b0070962", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "491177f4-729d-4baa-9bc6-f95696317fde", "comment": "Malware payload (Mirai)", "value": "867a0ce53963092497e480108bc4ffe619a2db73dfbbc24e6ab4f20910f69c6ada005787534f79a9f5825c6ddd67776d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356944, "uuid": "e5d21683-f79c-4b8a-af67-61678576a123", "value": "T1E8142A56F8819F15D1C502BABA2D524E37231778E2DF72029E109F74BB8B86F0F3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356944, "uuid": "db805a85-64c0-4050-9b8d-e0a11bdaddee", "value": "6144:PrN/+9nos2xNzDpbnbufAat+F0Y1yxJ2Q7xWina:jN/+9os2x/bbufAata1yxJ2Qxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356944, "uuid": "a37bc9a1-ce93-4076-a1c2-a2b50a323983", "value": 208948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356944, "uuid": "2a84cfbf-7e0c-474a-815e-71cdec93d627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356944, "uuid": "8d74d6d1-2038-45e5-a5c1-2f02311a3279", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e64991-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "616f4af9-9455-4093-9a56-69e8ce107f8a", "comment": "Malware payload (Mirai)", "value": "e606439da8b92a229c1e95cd2e5a213e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "7fb1d4a4-6797-471e-9abc-e5f829436867", "comment": "Malware payload (Mirai)", "value": "74d3625c35c6a80392894ac46498df13a158585c8ea39419f5074b4e10cb16c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "71b64ba0-8ce9-473e-acce-2808b8b48f56", "comment": "Malware payload (Mirai)", "value": "509d66aad1db909284daf6b7ece9eef1a4d8254e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "b526eeed-20af-4c70-9bf4-f37727da6a03", "comment": "Malware payload (Mirai)", "value": "d16e65e79cbd85a92ae79d534db022400a61f1b1817fdb435705a39e889eb38843086003840e00d73a63f43f04c1ec11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356943, "uuid": "dce42f5a-0e60-4f5c-b01c-1bc761eb621c", "value": "T15B141946FC519B12C6C712BBFBAE428D372917B8D3EE31029D215F25378A45B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356943, "uuid": "29c62477-5d42-4c37-b2bd-e4892d315f34", "value": "3072:NoO2byE+gBq8daYbJgdnACVtGeYid6bJGiyDvIg4:NoZB+0q83GnACOeYiesiyDr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356943, "uuid": "7a89aae6-c16e-4103-92d2-678c07eea730", "value": 192472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356943, "uuid": "609cdd28-b2f6-4665-bd9c-a486353d2a83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356943, "uuid": "da604b97-5135-4cf7-b3e6-c2b1b5424c11", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8731106e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1786374158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "f5a40fff-b504-4c7b-b64a-634e361fa4e8", "comment": "Malware payload (LummaStealer)", "value": "14853a4ecde96ca24c0dde6f78538add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "82643003-f6d4-4058-9ed0-bd3727f8633e", "comment": "Malware payload (LummaStealer)", "value": "752169cf776cf480fa525852704827f8754e140198c2b4c6e71d7d5283029db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "aad86cf4-c617-43d4-b29d-779bbbdb776d", "comment": "Malware payload (LummaStealer)", "value": "59be6072d23f840e97843482ef465a8d3b94c022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "1e248ee3-3892-4e18-af86-9326d3aebbc6", "comment": "Malware payload (LummaStealer)", "value": "fd580912d9dd06dd2d667e672fca168f191a2e7d8bf78aebb07668f6e9ef6b7f684ec5234d16464eff0d87c847f64562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "bce5ab12-01b7-4e86-9595-81a559fa9e94", "value": "T1B4C54A10EDDB85FAE003163158A762AF6735AD065F31DBC7EE483A79EA372D10836709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "36210f25-5fc4-40fb-a574-f2254e3cab3b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "bcaa532d-045a-4bfe-ba68-f6aa5ffb50af", "value": "49152:bgyqTt1odqXUtajyA1A8YcTDJLI6ibshUF:cHTt16qwMyANl59hUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374158, "uuid": "1e12dd3b-18ca-415c-9ea7-ee57d4c43c1a", "value": 2642776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374158, "uuid": "f656f37d-1615-45aa-abc4-c9d6fb110084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "9e93a709-6462-4b7f-92b7-be08788bb74d", "value": "752169cf776cf480fa525852704827f8754e140198c2b4c6e71d7d5283029db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52746753-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786371063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "891f08fb-f462-478c-b0a3-810a0ea88592", "comment": "Malware payload (MassLogger)", "value": "50b6f864ab6a44a044ea5fbd601c4996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "297d624a-9479-48ed-8759-7f15ba09333a", "comment": "Malware payload (MassLogger)", "value": "7522eee0bd9dd853ccef3b37b163c3b3d17ec37d124f1718fbb1acf29c6d162e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "ced24f18-b7c5-470a-99d6-1a2225e9ff29", "comment": "Malware payload (MassLogger)", "value": "5a6f0b170756c6a49d7d176af834efa40641b97d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "43f934b5-6d48-405a-8601-2b2703dacfcb", "comment": "Malware payload (MassLogger)", "value": "06ed1a020f1cfcc1bb96d5ee6b0a91e4bd6a7449e6ff42e0b421ad2765fae0633419409e9f51e1f094d27ea7795dc6e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "8bb26415-1b8b-41ff-9f02-958617716cde", "value": "T180F55C70D351B065D1A7C430CECA0EF4A5A1343B92366D1F1BC5D81A25FBE61ABAD3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "7c088a0d-1f6a-4064-a346-ac99dc23acec", "value": "f80b7b5cdfce6ede0a7977b27dfe83ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "76b2c7ae-67d7-46ea-b54f-5a994d617fa4", "value": "49152:vThEcMI4sSNJ8dJ0xdFIepAd1B9vbNn6Emft02SLV59MZBbpxUosT2DInj99GQkt:rkLSZ2IenTRDb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371063, "uuid": "69459fa6-33a9-4cf2-ac6b-a866ab0f4b99", "value": 3400704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371063, "uuid": "84e508ab-8a34-4dbc-9443-b737b8ba6b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "fe85f039-248d-4947-992a-d78dc338432e", "value": "7522eee0bd9dd853ccef3b37b163c3b3d17ec37d124f1718fbb1acf29c6d162e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b1937a-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "63853efc-8671-4531-8aab-143f7245b852", "comment": "Malware payload", "value": "4a32b07786a09eee2735eb909bcea0ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "127c350f-4da2-49ef-93a7-39cc45c8111b", "comment": "Malware payload", "value": "754ed3c76d7f2150933e134e7fa195d70f465fadcf8408c61634ee1bdc5d3a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "57e49e10-79ec-4dc0-b08d-5f4929489849", "comment": "Malware payload", "value": "2f3265e6951c0c16bc2be051b34ab1d3313dd0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "dd3b4ead-bd8f-44f2-a30d-767b1f0da511", "comment": "Malware payload", "value": "9319c102e4d411b0165a0e791dfb95fd56ca5c37e24e177e359df916400a623afd230a248b915011b4f3e88b18f63d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397375, "uuid": "1c54c974-8d94-4879-9fb7-124a6774ab2b", "value": "T106A3E70FBC5ACAA2C9969934C37F00512355874158BBAF736ABBC20DD76223BD7179C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397375, "uuid": "402d09f8-6548-4d08-93a5-c0970afc6542", "value": "3072:qeMAG+2391biK/8fVmOUCdYYphRilAtYMw9cMrWu:qey+2nbii8NmOUCdY4qtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397375, "uuid": "691cf653-7d14-4ff1-892a-774190a6e2b9", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397375, "uuid": "f2aa596d-a38a-43bf-8458-b33197bdcf94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397375, "uuid": "6d159837-1e64-451b-a307-22e8ad51db8b", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f9253d-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1786346407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "7d7784cc-7385-4ded-a286-70112a5da817", "comment": "Malware payload (DCRat)", "value": "108b0072f439f8b8e423d814e215645c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "52b1189b-e1ff-412a-9758-729dfbbad039", "comment": "Malware payload (DCRat)", "value": "75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "93c4be83-a61c-4416-8b3c-3d7e7a727169", "comment": "Malware payload (DCRat)", "value": "fbcf24564eb72125a095d4c4c20dd6e13f1d676d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "9d71c31e-ef6b-491a-87fa-f05e4c0ab549", "comment": "Malware payload (DCRat)", "value": "a042fefa4d1d2b535dbca5536f67157765343dbb62b68e02ca4ff7df0c293a258dce1ba3ac638f97d871f56902825ae2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "0821d70d-f825-4a35-a59e-214b6d86a704", "value": "T1AE0507027E48CE82F4091277C3EF45484FB0A85166A6E31B7DBA376E56163A73C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "b1aad875-ffc0-4e18-836d-173adda5cdd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "5c53646d-cb3d-4ff2-96a8-4eb40f0965c3", "value": "12288:Sjzr4mg5shusXKaRpu+FOTcW1n5n4oJK6UG4jU:Sj3hgKhumRptFtW1p42K6N4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346407, "uuid": "016e5b81-d24f-44e9-a7b9-7adce3eab191", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346407, "uuid": "04f2b36e-bab0-485f-b30b-b1fcde9549c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "089325a8-29c3-4fba-a56a-a0f410d3b4f4", "value": "108b0072f439f8b8e423d814e215645c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ca004c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786372621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "e7ffa7f1-7b22-406b-a5af-8e6ae492eca3", "comment": "Malware payload (Prometei)", "value": "ad58b4aafc9369c985c0cf69cc65e142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "cab6bc26-cda1-4197-97aa-a3fd9173d127", "comment": "Malware payload (Prometei)", "value": "7619b607d896f36ed8abc4b798765ab11893239c204e7cb60ab09b809da0d477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "e248bd2b-1bdd-4002-a8a5-2395d4e1c116", "comment": "Malware payload (Prometei)", "value": "d38a5894e7afacb1bda6c0244a2e3716e76d5424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "44b71c09-b4b1-4a7a-ade7-faf533c343da", "comment": "Malware payload (Prometei)", "value": "96996971a5798ba118ac4abf5ee9380f9db874b44c73a492cbc66463bc09693ed35ddce31825711d8d83cc9f8c4739b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "9e68b1dd-c0a3-4062-ab13-f92945cd9474", "value": "T19F34BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "c36756f3-f83b-4d4b-95f9-ae0480a7499a", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "21081114-5548-4ef5-9fc8-8f26223d728d", "value": "6144:VGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOn:VG60BpL8jk1FGjDc8GVdOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372621, "uuid": "5847b7ba-8436-4dd5-ac34-db0c6b6f1dba", "value": 245866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372621, "uuid": "c4c00cd8-7284-4c1e-9654-69d80d2f70b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "53e0e485-b3da-42d0-a53d-07adb9c0c6fe", "value": "7619b607d896f36ed8abc4b798765ab11893239c204e7cb60ab09b809da0d477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0c7401-9508-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786399718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "51fcc1ec-be4d-4aaa-971c-bb2b25557be9", "comment": "Malware payload", "value": "ab75f56e8ba7331dbdff2018a2929ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "3141508e-f04d-4711-ae58-b3a9558db1c1", "comment": "Malware payload", "value": "7688075202b5fbc5ddecc6bc85cc8606fe30e5bf8bddbe7d3cfafeb0f6f05896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "97fa3560-f7a6-4bc4-a707-4283b0cce210", "comment": "Malware payload", "value": "77c51bad7de26978ac958985d6f843e21cbee2dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "88156b89-2065-4f9c-bdc8-3533b3c7f695", "comment": "Malware payload", "value": "94206dd7c843c01cd384ae26200acdeb75d4c7e768b71c76b6335677fc7c590442346b4da63a53be911a2f5b9c238f40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399718, "uuid": "017359f4-cd19-4971-8167-3e5dd407062e", "value": "T11BD33B767B10AFE6C36CD5300EF28AA54AE6196319E394813365CB1CAE7051D2C9FEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399718, "uuid": "8cffd42d-9886-4614-908f-8835be0960e8", "value": "1536:D3EImlpz63Ip80WGQ28+yRqEm7k8Wrf3QcC64/cUUsEB5WZf9JcEQMMS3joA8Vj2:fy64/ZUHB5WZ/QacjPxAQfzXod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786399718, "uuid": "38e91848-40a1-49be-bff2-45f4a176cbb8", "value": 140068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786399718, "uuid": "04bd19ed-36e7-42c6-9704-bb7d0dea54ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399718, "uuid": "b2dbb6ad-a8a6-4a81-ad31-62448c82042b", "value": "7688075202b5fbc5ddecc6bc85cc8606fe30e5bf8bddbe7d3cfafeb0f6f05896.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db622a15-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "f2ee33af-9587-4017-bf08-36159bc643bd", "comment": "Malware payload (Formbook)", "value": "a395871f0aa1c385d46606bf18f037f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "6550f0ab-a034-458e-b816-f8709cffcca3", "comment": "Malware payload (Formbook)", "value": "76c453df11371a68c893fa21d2f60b3f5247f38966e304f1305c3e2caad2cffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "94edbe03-3f8d-46da-a2e3-542871e14af9", "comment": "Malware payload (Formbook)", "value": "3d1db69b5beacccca13215dae7666c1327ed5367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "acfcc229-b9b1-44c6-8db4-a74729b138ad", "comment": "Malware payload (Formbook)", "value": "6e96bf04d562ca43abfbd190906c19fa2e18ba7a62325c0cb34cce93b9007b9e575785b9be5953e00a24a3e0e6f203f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "a4d10119-093d-4495-b8ec-d04f361c5dd8", "value": "T1F935014467A8DD02C46A17B895B4D2781B396E09F912E3075ED4FEFBBD777228C0824B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "77d1955f-9dc5-461b-af1c-4a10781e4e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "21a7d891-157e-4c36-9b4e-f20241b43cbc", "value": "24576:OAZvV0LINEnFwjzf/9RuNptClFNibRsTUHpG2e:OAZN0Le6FYzf/9RuNpIH06ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369575, "uuid": "10d914af-21bd-4b21-b117-5bf1b2e56bc9", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369575, "uuid": "25a363ea-4237-429f-9b1e-ebd73b68fbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "661924b7-627d-4f44-9d54-81d670cae108", "value": "76c453df11371a68c893fa21d2f60b3f5247f38966e304f1305c3e2caad2cffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8107df9d-9506-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786399059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "4f3607c2-1dfd-4ecb-8ad5-6908d24bb081", "comment": "Malware payload", "value": "fd26026e9bb0db4318609ec74b9317b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "4457ddbc-355d-41f4-b514-aee29e57ca21", "comment": "Malware payload", "value": "76d4b3caa27c65e33379cfd6abd9dd305338530948733ea228d66a74e72c2269", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "58f5f030-a08f-4766-8b61-5bec10009dd8", "comment": "Malware payload", "value": "342d52ec4f580686f0daf216167fad4fac091c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "5a261847-f978-421b-b6e8-123a2dc903d7", "comment": "Malware payload", "value": "5aa74a5b7ef0ba098031a9df9bd728b543975bbca03db7c6a70c9950a003989fe86311650ae49e71d62f84c42b1a408d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399059, "uuid": "32838bea-924e-4753-8ba2-afbe00df9bbf", "value": "T1B1460797B9925983C5E83637A8BD81C433634EBA8B8752675D05FE383EBE1D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399059, "uuid": "e82296e6-31a4-4bb5-9a96-3cb151e042c3", "value": "24576:+2/HbBcecfpME/Tt9u2vz8Wn9XRNJ0+fFh7rZxaYfDr5K4gJJUgdE4L4amBrRu/d:+rCGm2Z5X7UQDYFnO5tS2SOeMTIM5El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786399059, "uuid": "7c8c649d-2de3-4dff-9304-38a197e59935", "value": 5767330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786399059, "uuid": "d8e94e0f-42e8-4d9d-9cf6-949a0835dae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399059, "uuid": "a391f692-3352-4c67-9416-f8fd76ebb79f", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8d2b1c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786372347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "f0a3429e-a163-4405-a585-1b42ad99218a", "comment": "Malware payload (PhantomStealer)", "value": "e2eac29a3ae14fcd356b78be00142597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "ab13cdca-d619-4f8b-a697-d24a78809f49", "comment": "Malware payload (PhantomStealer)", "value": "77a24411316c52e33e7ae621d6dba7830c01ace413b1a53dd2fcfa3e48695887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "a3c2dd6f-4882-45fb-944f-92d9c9c1b3bf", "comment": "Malware payload (PhantomStealer)", "value": "5078eb6c6c212ca9b0483181b0d51492f7cff243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "53d2f736-f025-42ef-9d81-bcbe7d73c4ad", "comment": "Malware payload (PhantomStealer)", "value": "dfe0e2acbcb7aff57e786fa4e8137dd6613b1357674997a40814e96ff3da497766a4cbe1509562ca202cef35f1729b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "626ad022-0222-40f6-8064-c3b0bd04e376", "value": "T15955D09C7250B99FC857CD728A649C74AA10287B830BE24391A71DEEBD0DA97DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "ebae477a-d7a4-428d-89e5-35e13f5f4bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "d641b23b-8860-4276-94ce-a1cac593b50c", "value": "24576:65u+Wj/Og3BGN2viU4arvrFvSR+xBZ0h342XZj+uEirC/iM3zyTAlz1:6IJPRGNCT4MFc+XZqXZj6osW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372347, "uuid": "dbdc3bd5-3b36-417d-bfe5-6822149ec7fc", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372347, "uuid": "8e186188-4e2b-4260-b7c5-5da4427db589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "9f82fbe4-417d-457d-ba0a-66ebe0391a47", "value": "77a24411316c52e33e7ae621d6dba7830c01ace413b1a53dd2fcfa3e48695887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2c75d5-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "942a2094-56bc-4fa1-9be5-4f6fb450bc32", "comment": "Malware payload (Mirai)", "value": "bf32078b169c8215b51ba6e1c7e6ade2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "8f555c17-7cb0-4a17-a592-99f202c8253f", "comment": "Malware payload (Mirai)", "value": "7826f1073f73991968b774fe7d9514c069e44b4f0477fe2429d5781523806f50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "2b299821-18ed-4074-bda4-5b007e2ae30b", "comment": "Malware payload (Mirai)", "value": "05865b355829f5d9dbd795498b8c1f107b811b3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "f2db0e5b-8de8-4b28-80c6-c4790536eda4", "comment": "Malware payload (Mirai)", "value": "1e1bbce941ae8131eb3b91421c53c403efecd7c08cf92ec0c1391a79014ce559c6bf34b3a156ae9370a73472b3d46e9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "1341b82c-abdf-45fb-bf38-105c360b477d", "value": "T188041996F880DE62C6D0267AFA4E429C331317B8D3DA7102CD245F3977EB95A0B3B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "70239689-a971-47b9-9bb8-7655a83732ff", "value": "3072:TUt7qbvtcRtQZmYshC/pIgNjtnL873yEyJzEv8Yy+HyH4a:TU8bvtUtMmjhC/WUjtgGEyJzEv8YlS4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383589, "uuid": "6a391cd7-a991-4e47-8b5a-b564fb247055", "value": 173632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383589, "uuid": "14fba752-93ad-455f-a4cd-079322e12015", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "322d304e-8721-4747-9d62-6e42340e03d7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa242eb-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786355624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "6aab9950-fa3b-4843-b57b-7ed64bc57be6", "comment": "Malware payload (RemcosRAT)", "value": "4b7cc89e3cd12bca58bf03d6bf8b6c93", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "9521d9c0-0327-49b4-ba40-978c046929e3", "comment": "Malware payload (RemcosRAT)", "value": "785b958a455b039014063c61a8cbb67ae22bc2eb7770c464545d0aa7064a8736", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "9d91d684-bbea-48fb-ab3d-3f463826f410", "comment": "Malware payload (RemcosRAT)", "value": "acc7255f0f7942aecf0d3df0cafba849b2796932", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "3b178529-1168-419e-ac3f-c9f241224ddd", "comment": "Malware payload (RemcosRAT)", "value": "9c5eee7a80fe3e0edb0bf35339d9b3a3e15d523475e7e3c2259808a2ce945bd5ae1b43850e5c296f669253ddb64e3f5f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355624, "uuid": "1e3e1679-b015-4dba-9a2c-20b8b4f1d7f5", "value": "T14D151212FF41997AD54A57320BA770D6D62CFD17EF62890B2301732EBD72BE1C86091A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355624, "uuid": "b17cf544-2e30-4ff3-b552-3c81e247236b", "value": "24576:ObLSv9k7OKYt1QRT/64rmQXVt8eCbmhuFen7i:ObL3OKYtmB6GXVtPhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355624, "uuid": "f9293178-226b-4894-9b09-63c1f1e9ac7e", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355624, "uuid": "562f09b9-5f9b-498c-b4d3-744572607977", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355624, "uuid": "e9de2019-1476-479e-af55-de2366040900", "value": "Invoice Packing List..xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e68d8a-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786372059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "38dc3b62-1317-41a1-8847-432e94146c32", "comment": "Malware payload (CoinMiner)", "value": "489cc8b6e89796bfa695402537227ecd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "4817f785-42a4-4876-a5ce-7511b322769e", "comment": "Malware payload (CoinMiner)", "value": "78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "3ea51cfc-f8fe-4485-a67a-5239fa988df4", "comment": "Malware payload (CoinMiner)", "value": "d2bb2fdd4a12a1deaa28f89d1107197ab51e46ff", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "378f985f-0228-4864-9579-5a07754197a7", "comment": "Malware payload (CoinMiner)", "value": "97e90224eb9139d384ca62fdbd07e4960deb6cb41c8642fbd4952fe5a3f2374d104e544ac80b45a8a90122116d9204e2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372059, "uuid": "cf6621e5-982a-4131-8bd0-41e26ae34ca4", "value": "T15D93A7B6B560C1703978C16C678B41506A4A703B355C382474AFB91CBFEC758A1FABBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372059, "uuid": "efb34946-fd38-406b-8338-d2e4ba36934c", "value": "768:6OY4c9t0v50fiAfQO96fKwtgiLgPjUbuK5puCLAqp1BDkcE4zvA4SNtrw1iTDDoN:9Yi0ffmcWpuK5puCLAqpPDkcE4racsEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372059, "uuid": "74a1851b-149c-4dbc-b2f3-5cc33e99d909", "value": 92445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372059, "uuid": "627fc8e1-fff0-44ae-9a8d-865d92bfd81d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372059, "uuid": "f5489c9b-df31-490c-babf-8ef1d8c93358", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb1c766-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "ba4fafd2-5a27-4762-a97a-39efcde0535b", "comment": "Malware payload (Vidar)", "value": "9c9ee20bb12d6c75a134a61c5a628d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "d707dd3a-3e41-4722-9308-71b0fefc6e18", "comment": "Malware payload (Vidar)", "value": "796e1b841172a93e58c1ac5cac613c8a24a93254cb5ad363c2273899c6781fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "14df0592-ce9f-4c53-a9e1-c6dd80e29485", "comment": "Malware payload (Vidar)", "value": "b395cb9586fb676942fe435c2d0f004b237e6b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "4383dce0-cf17-4557-a7d2-b1a1d140cafd", "comment": "Malware payload (Vidar)", "value": "f0e7fb65e493987a9198dcbb2a5a680122eb19f9805f0c5033912bd2bef8d5176f15517a10e3fa71f0428392488f0de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "1e82641f-5c4d-430c-bb17-5ff5a776d150", "value": "T117926245E207EAE4C4D5C336A71A526355FD7C6032315A3B9BEDAB3A0D42370E7902ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "2c3e8955-2502-42cc-99fe-53559b54022b", "value": "0fcdbe8dc380312e1e50301da9558e95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "d0103a43-4fb4-4e8a-8c40-9c497d37614e", "value": "384:O8Fq2ZsQHNuqpn8UTcgf5M1Ie7gg1c4gXo7Zj9MGKjIG9lOL:lQ2GQHNdFhAG5Md7vtbxKjVHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368158, "uuid": "d04d5a7e-6975-4c8e-b178-301e7eca9a31", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368158, "uuid": "136ecf3f-1f98-4eb4-963d-c2d55bcdcfcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "02f6326e-c41d-421b-a2df-8b61d37dc7fc", "value": "796e1b841172a93e58c1ac5cac613c8a24a93254cb5ad363c2273899c6781fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17519c93-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786370964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "ce5b8d93-cb68-454a-8815-4cf19b0170be", "comment": "Malware payload (a310Logger)", "value": "60cb09ed4635e65d83f711013565c68f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "29683d00-fbe0-4950-8252-49a7427adf10", "comment": "Malware payload (a310Logger)", "value": "799ee85a7c9e7c5cf0c30f5edbc3d5565f7ffdb90af08feaf2b3f6cdabf32633", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "6cbf45ad-e2ac-43d3-882a-99590c5f2e61", "comment": "Malware payload (a310Logger)", "value": "139e2c2ec4ca86d72935bdecab588a1debe22a8f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "62759635-1a15-4a8e-9384-42a7dd08bb59", "comment": "Malware payload (a310Logger)", "value": "01c25d265b854f142c25a70b8a1eeffc10fc542fed05f33adcde3bdf1cd1e39ac615a245785af173b143419f2f2bd089", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "5dbd1c1b-70b7-462f-9e28-21bd4773a04a", "value": "T13A944A13EB60A11EF1A389B1B9B5925A68277D351B98EC4BF3408F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "418059c2-f693-4891-84ea-c177fda31368", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "99fbfc7c-a770-47d1-b493-609dc4007c1c", "value": "6144:i8d1/w5KA81IJ8GpF6nuTmOOUiBUrjIflBVupeG9+taBX9P4yhDj3Mb:RjYKkJj6GmZUiqrcvG594yhDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370964, "uuid": "96496c2c-9d1d-4b35-b58e-1e5dabd790ed", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370964, "uuid": "9015b53f-e406-4c9c-a236-904f5a9d930e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "46913d08-0c44-44e8-95ee-8066f35cea75", "value": "799ee85a7c9e7c5cf0c30f5edbc3d5565f7ffdb90af08feaf2b3f6cdabf32633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3506b87-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "e7059794-0f09-405a-a34a-1470adcac532", "comment": "Malware payload (AgentTesla)", "value": "2ca165bea137359e6f2af2f66d59bc4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "e43c7c72-7241-49d2-b36b-27bf1d69d338", "comment": "Malware payload (AgentTesla)", "value": "79abf671fb2d8e469a8c3787184244b28584c97b0a004cde920b06c97593654c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "1831a5a6-d7f6-4f9c-8dd5-7143bbf1f240", "comment": "Malware payload (AgentTesla)", "value": "b332d60260ff5a491a8f1183ed3eb41e284e2a80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "479f970b-5f60-4cee-8f33-69ea17c7616c", "comment": "Malware payload (AgentTesla)", "value": "b1e584021dc483d0682e49debebf5e56e59c8cfdeafc018d65ff097c5c129650c3ce648b852a4d706eb6b93edc1467d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "58fcc737-8afc-42e3-9c0e-386148ccc048", "value": "T1D155D045E3845994EDBDA7306636C83147B3BC59AA34D61D28CD3CAB3FB7B825026723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "2d4ff21d-51a3-4e0a-a739-cd016a0c893c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "0eb3a77c-ac82-4b1b-9b64-da423f67ecaa", "value": "24576:dsOF8HKLZ4e2sAh8cYH1Pq6+e4CAKOE/GeiiO1q:dT2HKtH2t2cYYRCAK/GJi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372568, "uuid": "68874380-30eb-4ef0-b8ce-d04a2cbccafc", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372568, "uuid": "b45e59c4-c41f-4442-a78e-1eb47317c6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "dffaad74-3c38-4066-8592-80acdfc3b729", "value": "79abf671fb2d8e469a8c3787184244b28584c97b0a004cde920b06c97593654c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ca86d4-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "e8866770-8811-4cb3-933e-6e292f5f1785", "comment": "Malware payload", "value": "ab542b3940e50692bbf9b105d7a7524c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "d999bb09-21e9-4175-b7b2-e1215d54a184", "comment": "Malware payload", "value": "79f7dff95246ba640daad1753eb0caf9994cae316e54880720c1110f1d05352b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "3a2110a3-1324-4d00-8654-b14d7467f547", "comment": "Malware payload", "value": "aa69ca84dbac07ac88e112206dc40a9ba8cd7d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "c8709a30-04ec-4065-9761-07b1d1700730", "comment": "Malware payload", "value": "599dc12435a0bc0db520da1b1339475c095cc325ed2e1a154ef87f0c0e147e9c7ca8176d4789d8ffe1d060df1d800448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "9862ea6c-800f-4f37-95ac-e7543f67bc67", "value": "T1C8A4229DE92113C4F2E4207F96940988796EF22DC3045BD78729A57B1F0A7D019FBAEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "afd69869-7c6f-4e7d-85a2-64eb7af3e687", "value": "801f57a932807da2a7faaa453f83f36c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "e35aecab-c468-4240-b4ba-0bf4a344ade8", "value": "6144:PXt/QR/xji0SPqnOmcZ7stNPX4RwcKKafVa/o0gGHBpNogupky/G:/U/0imZotBzf0g0opVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369596, "uuid": "d9653527-dcde-4871-ba81-5ae6ededf1ca", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369596, "uuid": "f99677ed-19d6-4fb9-879d-ba2c04edb604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "d50912fc-cafd-4685-a352-7aa66d8e42f2", "value": "79f7dff95246ba640daad1753eb0caf9994cae316e54880720c1110f1d05352b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdd01f2-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "786f15cd-f0c0-4b00-b3a1-df0823039ca7", "comment": "Malware payload", "value": "77927d7f40024ac60210528bf2cf049e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "91f0a276-b68a-44d8-bc8f-81c578dccdf9", "comment": "Malware payload", "value": "7a07f4e25719d0e5f528605949703e63179db70e9522399f3cee8bfed46d7624", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "d6dd3d66-fa5e-4156-8c8f-4cec97aa9e9d", "comment": "Malware payload", "value": "786c2c19550f274f65da596b4834270b38d58dc2", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "0add11fc-789e-40b4-979f-cace45b91314", "comment": "Malware payload", "value": "f131f3104a8376bed83821bd671bf3f1ac71ca5076f2861861d78a0b24cbac976ec1735657e6816545e6dc97c31a5090", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "ed1bf0ae-e008-4d00-9ce9-21278ea3d358", "value": "T1CD766B13E99588FAC0A9E735C9BB4216BA74B809473133E31E617E782F723C16E75B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "415ffd12-5f85-4d86-ac5b-039396186e1f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "88f7f6fd-e8d6-4bb4-92dc-a87cdada89d6", "value": "49152:/OE8+4wP8ea7mNouSblIwFLxDI6IMf/FJlyPMP+XefABX9+foNNWOaUAdUWC:/UnbG0FJZNfA/2jUUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369336, "uuid": "0392bb72-b372-414e-8c17-e366374427d3", "value": 7121776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369336, "uuid": "be305f71-1f08-4916-9955-d8ac4d5deccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "449833aa-cae0-4dee-b29f-3a8926309c96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98271cd-94f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "22608d3f-ce22-4d30-91e9-67b0c4400a45", "comment": "Malware payload (Mirai)", "value": "5c5415387970ba31a1460e7594b0d9fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "a08d42ba-a511-4937-b35a-3fde4743e2b8", "comment": "Malware payload (Mirai)", "value": "7a372f7277fac64975cbb9dea08b66a790396d8997f317987eecb6320e2af4a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "c27e4d53-28a4-4535-8a96-18d172834aa6", "comment": "Malware payload (Mirai)", "value": "d9cae663625b4827744ad9d110c32346704f3669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "d15bcc82-c338-4944-b8fe-53c4685b1414", "comment": "Malware payload (Mirai)", "value": "ee8ffeb4cd1988eafe62a12b2448ec5482b218a0314f2f8f9bfecf35fd141b3d17acf16ddc14edeb72e5277c598d5128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390161, "uuid": "d1508d4b-0fbc-4945-a997-6e2e3f3cdcdf", "value": "T1C2E30945FC418F17C6C265BBFF5E428C7B2A1769D3EE720399256F20379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390161, "uuid": "9994bc50-d957-444d-bc86-7e4178238147", "value": "3072:E0e2T3/eRX4sgkQy3ydhPt0OwwqJ6Gi82FrlYqNB4kH+:E0e2T3/uxi/Pt0OwF602hqYCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390161, "uuid": "fed94535-4473-45b0-a25f-1407ffaa8c04", "value": 146360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390161, "uuid": "29a60317-f008-4d7f-b877-e591347e3335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390161, "uuid": "785e897b-3550-4c3d-b0d3-ccc8343c9c47", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808d90f3-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "86488d9b-953d-4322-ab90-2adc6cfa0d97", "comment": "Malware payload (Formbook)", "value": "42e898279046868ae8df76543bd5c533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "ef4fb7b9-11c1-4eda-988e-6887b175400c", "comment": "Malware payload (Formbook)", "value": "7a616988466313ea0be51292e5e3e1e6078c424c55d17c1d2f2413129916780b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "d1923100-bb35-46ee-93c4-24acdcf341f9", "comment": "Malware payload (Formbook)", "value": "d0ffec1796e220df593cf72cfe4b6fe42b7a42f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "fca67ebd-0df8-4e2e-b73c-6d5c2ff2bb55", "comment": "Malware payload (Formbook)", "value": "4ac5a91da67553ae42e95a03c1606056614315193e6158bb87d7658b332e85303a423f385319b6bda0e7c5598fb8c994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "54273491-d8fd-4782-a82f-c5705516f8a6", "value": "T16A251294BAD6DF1AD27987B08AB6D0B04772AC2ED421D3074DD9BDCFB6347021918B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "68e63f8b-aa03-42ff-9daa-0278956e1791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "520daa4f-6930-46a1-8629-15f1de05df2c", "value": "24576:K4j/Og3p8R1pk9sEte0nK+wlWk644mgdjEyVGY:hPZgSlte0klWk6SgdjjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372429, "uuid": "3a06cc53-a976-4e45-bdad-1d19a16deb0c", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372429, "uuid": "455c6ce0-23a1-4bca-82b5-c96e120e4174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "fa95e9cf-bde6-4ba4-854b-c83f9d087df0", "value": "7a616988466313ea0be51292e5e3e1e6078c424c55d17c1d2f2413129916780b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8924a3-9488-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786344748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "e87ef35a-abd1-4be0-aa5f-c28c55dc9282", "comment": "Malware payload (Efimer)", "value": "81ac55ce8354ad51801c5da79b17b88d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "bb02ae45-4229-4763-8d6d-51fed708f30c", "comment": "Malware payload (Efimer)", "value": "7a9e33c51367c1f29aca8d70b6205b76d27edd1e95bfb3d6a5dde22d853d3cff", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "fc68994a-600c-4fcd-8f5c-b0ba7e4d1e5a", "comment": "Malware payload (Efimer)", "value": "d52e479d1906e3cd728a90196f1139af71bd0133", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "6fb17eaa-e9d2-4cf1-be27-0ed5bc3f33dd", "comment": "Malware payload (Efimer)", "value": "27c71bf755e3a16e53dc93006b16133e1fd697a365e81d62847d6b7bf90301096c38a6c8bab06dcc67257c3dd36fa018", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "ee32c24f-f0cc-4a85-ab6d-c1eeb09fada3", "value": "T166E6334452D113FFDA73807D6AE016D4DCB1B8B51B32C5CF17D885E29F276E0893AA2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "c5e7f577-ca37-46a7-a69f-0ef412914c90", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "df2303fb-6476-443e-8283-4aecd6dd69c0", "value": "393216:bGmAgxzrJOiaGFYj9DoRXMCHWUjPcuI3/PGTAI:bGP8JHvYj9DoRXMb8EH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344748, "uuid": "85b5d243-729a-4275-8c52-1a0dcfa19df6", "value": 14284252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344748, "uuid": "784e20c0-e8e7-404f-8cc3-e4f6f0c76fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "eca89215-127b-4c75-a970-cc90edf9012e", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4774de9-946f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "eb29b361-dc9e-44ac-a313-310a0d339648", "comment": "Malware payload", "value": "c058f70448dc1e37431e67a6238f1a09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "0788750c-4b26-4555-b74f-2a1df4f0dd90", "comment": "Malware payload", "value": "7a9f78520796c234afcb07e3c0d152f82d28fd9ece143f26619815590bd25735", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "43225a7d-05d5-4e2f-8f1b-d68a9f07d41f", "comment": "Malware payload", "value": "2c8820ccc1f37da29fcd3fabfdd20b1cb1bfaef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "148a3c85-063f-4636-81a4-cdf6e92cc4a8", "comment": "Malware payload", "value": "7b6b1d0e258b6e8a4f9d01855fa433620236f9641fa76ff4af959cbaed83c2a84fa0c6a3211a4e700b25c7a3529f3633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334318, "uuid": "61a14c53-f0cf-4bf6-aa76-245542b9dbdc", "value": "T193632A3A7706AF63CA7D52350FF2CA79E9E0365218E290487342DB1C6E392696C1DCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334318, "uuid": "7c288805-4c39-430b-ba20-66692f027231", "value": "1536:2rSp697SSwmWELamswOQvuw3SnrUqnrE9WPfvE:7+OmHOQvZCnwqo9Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334318, "uuid": "528dea5a-c3e2-4027-94df-e248c232a4dc", "value": 72884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334318, "uuid": "4eed5472-fa89-4ccf-b17c-b4fe74444327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334318, "uuid": "199348d5-440e-40f4-8b75-6985c8e2ca2e", "value": "7a9f78520796c234afcb07e3c0d152f82d28fd9ece143f26619815590bd25735.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcc2bdd-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "ca2aaa05-79a7-4ad1-a269-77ea7991e41a", "comment": "Malware payload", "value": "f6e4d2fc174ae73b533ad0e18295f758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "471cf3b3-367d-409d-afaa-17f81b6ff34a", "comment": "Malware payload", "value": "7ad20eb6d7e7ebce52849c426fb0bda4beec610ba06c29a2902e0882ecbd8184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "e2da5048-eaec-4bfd-b994-6b98ec849973", "comment": "Malware payload", "value": "bab93cbd581894d177481fd274d378ba22374d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "73acf1f9-7087-4868-8a74-fcf18b127222", "comment": "Malware payload", "value": "edd9b6539ff0b797605a2f2546481a22704bd13e746a624bd73dc74afb5b8555a603fdbf752c3f5c90eac4d8f126951b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "df94cea3-ffed-4dd2-9489-4a411be7c0ad", "value": "T18F741221F961F853CAB4DA32293CBEBA0D7C8F695846632B1F10B6A87D71742550F386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "e1c09502-eccc-45fd-a3a6-cf45004ea379", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "9fed7e94-dd10-48f9-921d-b0a07c374961", "value": "6144:gGMoidXz0d+jF8s7aiAH0zZHkQey566NDvuIZf6mej:gGsXZjF37aHcWIjej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368690, "uuid": "0ce9d89e-65de-4de0-bc0b-f4f7942c1d12", "value": 347264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368690, "uuid": "4e219d7d-3b3c-4467-b818-7fc0ef8c5301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "bc892828-f7cd-456c-adb0-38d4f6c96689", "value": "7ad20eb6d7e7ebce52849c426fb0bda4beec610ba06c29a2902e0882ecbd8184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6b741c-94b2-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786362868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "064caddc-c510-4c46-9248-87ee6324386d", "comment": "Malware payload (njrat)", "value": "df01c944343e4f1bfaa7d5609b2c817b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "b0c85e90-6f9a-4c54-b337-628e775e4ae4", "comment": "Malware payload (njrat)", "value": "7ae00fe824c9740db553a800fae168a1a06de02eee3688694f05563a91416f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "20c36989-1e45-4d3b-926f-d59f24a3af1b", "comment": "Malware payload (njrat)", "value": "965f9bcc4cdb2fe1ff687324a2d0a2fa9a38ebc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "47dcb2d3-e8ca-41f8-9e95-70c4caa17e73", "comment": "Malware payload (njrat)", "value": "2d8c7d0241fac7b85bb63532539a1c82f7905e74db7a7e4e352dd0cd8772eeb8e65343d4c6331b257c961eeaa66407da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "24487698-a9df-44f1-9f73-ad6a6f474fc4", "value": "T132A33A4EFB054A58D16D0EB789E3958802BDD4E7AC27FB7B18D89EF19C628CC854F580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "9e73406c-0655-4bd7-8c66-b4b58ad43be6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "4f60ac9c-71ea-4ea5-b4fc-d817f54409f2", "value": "1536:3yatiBJi8YJpKDG5lYDh6Uw19uqodpdu22nMpybnaxOxK4S:rIY8Y/KDDh66NnuPnMcbnaxOs4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786362868, "uuid": "d0e42e45-f7b5-413f-8bc6-3af406656a8d", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786362868, "uuid": "3bc10735-5a8a-452c-95e1-2e3969828bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "6a1f405b-c40c-4158-a721-27e4c7103feb", "value": "emulator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71900077-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "61675338-7a83-4a3e-a0d4-924c1d262c80", "comment": "Malware payload (Formbook)", "value": "b4fdee1d0631824ae370ff694468156b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "b4d11999-7dd3-498a-888a-e370fb75c077", "comment": "Malware payload (Formbook)", "value": "7b3b5d14375e2c12836e28bb0d9b277a1207e286f8b0386acec60fe2dced747c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "e6b7bc89-bd6b-4e56-9b6d-33b497bdb4d0", "comment": "Malware payload (Formbook)", "value": "6c4373a45f50437b2552f9e6f6239e3cc0707e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "cc742479-3b35-4973-9b60-51d0416b63de", "comment": "Malware payload (Formbook)", "value": "202b574b2d26717dafc5cf011cf514c70ddba1e3253001e562dd4e2d8f31cde118e07b1fc3842e04c99d4c0bb7e701d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "79153862-3976-4f93-9141-8c6876b62193", "value": "T1B01522B27369DF19D2B607F44AB6D135A3B67E8DE431D3010ED9ACEB3119B1149183A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "1601ad42-690d-488b-8859-5b83bb7cedf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "0a07a9ce-acec-4a6b-aa59-38d2133cc7a5", "value": "24576:HO+L/j/Og3njP5pKH3JIQWS2BT9tXmHQWNUbxsyY:HO+LrPTrKHyQWtPBdVGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372404, "uuid": "5c40e470-795e-4305-bb00-f4dd795245d6", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372404, "uuid": "bbabda32-4ee5-4bcd-b134-85ff080b6e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "b672dcd7-5efd-4cb8-9161-6e0da865f071", "value": "7b3b5d14375e2c12836e28bb0d9b277a1207e286f8b0386acec60fe2dced747c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209963a0-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "f39d1c41-983a-4583-ba50-7559eef95867", "comment": "Malware payload (Vidar)", "value": "612b3f77c6483dfa3e3349e7643ac3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "17815a67-64f4-46a3-b8c9-7e481fcb3a7d", "comment": "Malware payload (Vidar)", "value": "7b3b7b94166df2fc604c904765f25067302cf16c53c064d8ecdb01b22a7b8acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "0aab4f67-bd2c-440c-b4d8-8835dfac8031", "comment": "Malware payload (Vidar)", "value": "1ee7f77387bef9f3eb8a4dc82bf6c0e1f21c49d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "54dc98e9-a5ae-40a0-b572-1958a2f665e5", "comment": "Malware payload (Vidar)", "value": "d85a3cde330310ee8ef0bccdd8546470b44eb17836c70d4541a28adf77b2816cf63d985fbc875a793b29811129a6761f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "c88bd8cc-b4a2-4c59-b679-c36d7839ef85", "value": "T130828386E1579AE5C4E2C332636B526755FC7C102231A73F9BDD6A7A0E52730EA043EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "8490b9b1-651b-4dfb-ba36-c74a249933e4", "value": "adc71141eace1722e53258f5f4fda538", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "e7957197-281e-4d27-bbb5-b0006cc417ad", "value": "384:OWrv0b80c5rt3fUDua4FeMgt7Bw7v+5bj2Dl:Br35MQeMgvw7v+5bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369262, "uuid": "973ba936-c86d-4a61-b96a-a1cdc3edd131", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369262, "uuid": "0297b222-a5fe-4c15-81d0-d8c32b43df0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "c3436dea-78fb-4232-95ac-fe2b874544e5", "value": "7b3b7b94166df2fc604c904765f25067302cf16c53c064d8ecdb01b22a7b8acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80aa44d-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "63ca5069-981d-46c5-ae79-71ea577c4f63", "comment": "Malware payload (Vidar)", "value": "c758ac951ebd4ff54ea29abf1737c941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "0fe58fd7-724c-41a1-9c28-518b448352b8", "comment": "Malware payload (Vidar)", "value": "7b97b1b2cb261ad5c6007ffee856d8ab53d6ebe607a9092f3c9af930c2250064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "b311f8ef-84cb-442a-ad0e-06615bb46f88", "comment": "Malware payload (Vidar)", "value": "2ad311a523856a1e5e65b6fa27a6413ade32a9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "623f8f1c-bfc0-4a31-8de4-514911068a73", "comment": "Malware payload (Vidar)", "value": "8ed3d831d0393c7da5b387a760e67e2aa1921dda4b286c669b17f5de35256ae6eacc45bf9bf71538e3bfaa695ad3558a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "c0621c19-fab8-4a9e-b3ee-067cda02eac0", "value": "T19752E98A72A6F1FCD1DC823CD99E17B7CB163089131B1EBF59DCC6646BD320154E8A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "12e86cda-62f8-4fd4-b5c4-7ca5f952bb83", "value": "61157f0808e90a1ce9612e876dcb9f9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "b2fefd63-2333-44a3-87f9-37a5c149e06f", "value": "192:qxhYMFQYKQrnflp6JmOewswgigqX6Hzu/odUET0DNEzP6+9k88a3V:qxhYez6JmOeaTgqWzugmZDNEb6+9k6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370777, "uuid": "cbf8d676-7517-4e71-9b73-449b529877c0", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370777, "uuid": "3bb303af-0cd0-4441-b147-628cb74ea428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "0307b7a3-66b2-42c7-bbb0-97b15de92767", "value": "7b97b1b2cb261ad5c6007ffee856d8ab53d6ebe607a9092f3c9af930c2250064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dded1c-9483-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786342890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "8ef85e21-ac3e-4b9b-aa86-e17ea33f0927", "comment": "Malware payload", "value": "1ee42a45852325b24489c14e17bd2477", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "a27c83f4-542f-41bc-8750-6050dff47527", "comment": "Malware payload", "value": "7bb41e811f2107a3182da9090f24893d3612b5b6310194a7dd1f9965ff29e0c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "bb8557d8-f376-41aa-81f9-9aed35df4d4a", "comment": "Malware payload", "value": "b1a6ff3179a0ae87713ff0cb5ec85707596140de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "3e5b148e-6c64-4321-80cd-31b5cfdb5ab4", "comment": "Malware payload", "value": "ac422b765356d8a43d94b9986b6a65dd37e1fb3f8f6e7a5cd32fe6e66218c53fbda982eee017311e467bc16e414e8923", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342890, "uuid": "529fcac2-a119-47de-9d7d-8438e23faf7e", "value": "T19E73A526788559B425CCDE6C48FA5C50273C900BCA0A2D2CF09EE5D83F76A78F5F92D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342890, "uuid": "4eef5f0c-bcff-4bfb-81d9-b7344a68a55e", "value": "768:moJjXKfWEDcQPyT9r86roAhF46UwsdWA+jju4:mOEDcQPyTuvb6jGcy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786342890, "uuid": "3f21e09c-a6ff-49c1-a334-474a2b1d6f7f", "value": 77269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786342890, "uuid": "dd6a41e6-14a2-4c55-bdc5-3a041a6c8e32", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342890, "uuid": "8d3cfbbc-615b-4440-acee-cd382250f3ab", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcdfada-94ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786387967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "03e067f2-6c36-4a1c-9af9-b401a675c207", "comment": "Malware payload (RemusStealer)", "value": "cdcaf37baf2539da7f88a14b85460cec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "de6c370f-23e6-43eb-ad88-922a799867d0", "comment": "Malware payload (RemusStealer)", "value": "7bd899846f7782027431f3a4f582b166f6944bbc4fdbd86aadd78c248c57f485", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "26ee697f-a15d-4999-904c-7d366234f826", "comment": "Malware payload (RemusStealer)", "value": "4d341cd67a487a68ec805bc1c97ab24d5764ad91", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "d30fb471-2a2e-4251-b00b-5e422914825c", "comment": "Malware payload (RemusStealer)", "value": "5699f2cd83054937f09399e1aeea5bd59914163d95612bfea7bda84a9ee393de0446028571068625c5c0e15de1b0afdc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "0b0b28ab-5f67-47aa-8a2c-6a5e3c60c33e", "value": "T15DC6230133D840DBD8B15B74C8E7575A4A72FC824B78E7DF12A8A85A2F739D4A431BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "2b248349-0814-4fc9-8d89-f85352be06ab", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "6456407e-4bf9-4556-87ff-b8af15d2ca32", "value": "24576:lNNpmTB2EV3QHHArllTtl0FEF16+afrOUkNh4ie:lN/m12E2Hg5ZKwAfrOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786387967, "uuid": "1db8a5b7-1735-49f9-9552-ca6e3e953c59", "value": 12582912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786387967, "uuid": "ada2fed6-cd2e-444d-9896-b580198c5f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "c2165f0f-5248-4b2b-a922-c1512a9bfa86", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21c8054-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "336fed62-1bbb-40dd-9780-1a7644681a4b", "comment": "Malware payload (Formbook)", "value": "aece51030f9b0995339f61198ca54d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "82369f41-5991-4f49-bc0c-ba7e1b0d4e0b", "comment": "Malware payload (Formbook)", "value": "7bedc76599718c8e3c1ddb13bc31e0854c7a5c764eecee4026c9d8c88f4559f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "e951cec2-2899-41ba-a29c-cbb8fb4474ef", "comment": "Malware payload (Formbook)", "value": "cc074d4e482d98aa73b22cb5c02b158ac395c67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "b904c7f8-02b1-438e-acc3-1a6a3c93b300", "comment": "Malware payload (Formbook)", "value": "3ba90b0a6c374ac2cfaf00b7824bf4330c7a14a0d17cbdef40ad22b0ef63dc8763fd899848efe2ee3461ae5c3f86e831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "bf950f99-f3a6-4293-b01b-6bc16b92648e", "value": "T14E351208235EDD02E0864BB08E71D3F41AB91D98E531D3435EFEBCABBA3AB467445391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "e38271b4-b425-409a-9485-c86adb3cda91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "a27d1795-158d-4971-9a2a-b790c421c0cb", "value": "24576:ZZkYeJa5Gf5zEKzby9WoasV54/8ZTqkjXuSwhAo0E08SXk1xHl:ZZg8CW9Woasv4/8ZTpulhAo0x9UbHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369157, "uuid": "537fbd08-a008-4431-ae39-cac81e195caf", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369157, "uuid": "7b401d07-6df2-4d5d-b494-5f148699edae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "e7e09ccf-bc02-4f99-8b52-6c18780c291b", "value": "7bedc76599718c8e3c1ddb13bc31e0854c7a5c764eecee4026c9d8c88f4559f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c0029c-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "34b9486f-ca7c-4f59-90d0-3446ea713fc0", "comment": "Malware payload", "value": "ead0e809fab3827f5228618a15710e2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "368ca55e-a83d-4c77-a0b2-ea3e08b5acf2", "comment": "Malware payload", "value": "7bf7e6decac47c1d1e315a8ef07a83ac148467fda3d6e284870c22c4d500314c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "d2941197-a2e1-44ab-b60b-d6a78bcc54a7", "comment": "Malware payload", "value": "f519656a07d56cb8e2edd157a259e24ffaebd243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "1030e71f-ec5f-4df4-871c-64d90cb8d3a8", "comment": "Malware payload", "value": "6bb1b563ba661e4684fe2394b0ccdccfa52b91cb111c58bfcf1a207a0304cc0d0aeaf1417ee8a54695b08d25c4979e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329223, "uuid": "6ae15f36-2ece-4ca5-afb0-f61d0843199b", "value": "T147530A23FB0C0452D8D36EB80E7F0BE68315AD5120FE9115750D6F9A1B36F315687BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329223, "uuid": "73e5e8b0-af4e-4802-a34a-2ad79d7b82c9", "value": "1536:CmaT0Yvmt3uyanB+gRy58YB1RrSMH/2H1Aqft18IoME:CXT0YvWehB+we1RjHeH1AK8fME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329223, "uuid": "83934b8a-60ab-4c20-8569-0c3b71bc370c", "value": 66376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329223, "uuid": "a7459b61-f491-4b50-a923-321cffaecbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329223, "uuid": "aba95aed-b838-46b4-8a8d-0fcd31cadf6f", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6c5144-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "47536fdc-25a9-4bf1-83b8-90d8f815b101", "comment": "Malware payload", "value": "6c5dc5461f9d12b98c2222b9ef00f1d5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "c9d11f2d-1cca-4c5c-8f30-b6f9ee49c569", "comment": "Malware payload", "value": "7c102c60e089f5fa941f1abaa409dec4edea90d0f4853020772a3cbc47003afe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "50cf82da-ce38-498f-9b74-f24fa15c3034", "comment": "Malware payload", "value": "469356d59f0351e288023ae8766ec9c8e8181f41", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "b02e9120-8bf4-45a5-a839-89e63cc93e90", "comment": "Malware payload", "value": "42ce9c03710c0acfc199e9001b65b0a944bdc21018cc02ac8090070acd2ba9f6784137ab4eecbfd746dc14cd79611023", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348421, "uuid": "a8e03054-cdfd-447a-b2a8-5a526b38a801", "value": "T188C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348421, "uuid": "1a17a221-e711-417e-ab17-40f3b84cf598", "value": "768:qi78vCB+25j6es8Rh9FYpMSUpi+20qUpi+20YQX:qi78l25JXd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348421, "uuid": "37f4c2fc-fa10-417b-b677-79e4c04fbde2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348421, "uuid": "c6426808-6b2c-474f-b971-9e80fdc95d55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348421, "uuid": "a3f63bde-2dc6-498d-b522-c1f0851551fa", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9453e4-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "9cb2e7f6-f118-43ae-afcb-71af968f0928", "comment": "Malware payload (Vidar)", "value": "4420d76f99324330708aa39799d44886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "60d85f21-0791-45a6-b689-eb68554160a9", "comment": "Malware payload (Vidar)", "value": "7c3ecd29426f70eef787f2972c9704ca49b42b8f663cf486e888b1c104068ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "0857a0ae-130e-4bb3-b11a-409b3dbb103a", "comment": "Malware payload (Vidar)", "value": "62ae934683e98efa764e3ce2be154966e31c4882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "f526d9ab-0e43-43df-b97c-25176bb10053", "comment": "Malware payload (Vidar)", "value": "841e742d6e971b8a68baa6821278ed7b8562f0c5b1d4bc34827c80b0b8bd7d77bce45c24be746ca52d738f01668678f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "34c733c1-30b2-4624-891b-3ab9c8e6f3f3", "value": "T175826149E217A2B8C4EBC737635A562256F87C4422355B3B6FED4AB10D52330E7183ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "454a43d5-ad0e-480d-8e54-332e1b404805", "value": "66ebb7345b7f4b21730e0a314cb2039c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "d5899d04-57f0-4e94-ab6f-201e40a50f9b", "value": "192:OdmTwOzXxU1YGODefmO2hUrQ8ZFAtous6vW2g42H8gAdYuiOXxxAYdI1Bpttwp8D:OdmyJtre8Zutoute146P6A3Bp+8Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368208, "uuid": "c899cb6f-3e01-4b57-a38c-b61618dc3628", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368208, "uuid": "1456bb0f-6327-4ce7-8032-7d0873555b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "1d7d868d-9c18-4a0d-94b8-a1d223ac0b3b", "value": "7c3ecd29426f70eef787f2972c9704ca49b42b8f663cf486e888b1c104068ef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd33bac-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "4bf1c92d-4e90-4d7d-ad69-a3e8e8775145", "comment": "Malware payload", "value": "52f686b92add93e186abee9bb03d8e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "256b2bdf-a0af-4d22-b356-0f6249f83709", "comment": "Malware payload", "value": "7c49c82d332a3cc49b9248abf3bb01c31309eaadb558e595f64c9dde0512f716", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "44d4b404-bd56-42b2-9374-2f75d87045fe", "comment": "Malware payload", "value": "1a7fed58bc4831b6358a02a2e54055b5e141e459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "76822053-7780-4e3a-852b-a6d6139cd202", "comment": "Malware payload", "value": "58c4e6dcc339b4c63ca779cafda71ea260340bb25d61a5874c3006ed325dbfaab47ec349c9addbf7b8a3e7e728f63265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330307, "uuid": "7e55a370-93b9-4220-a432-f59e3955019d", "value": "T1E753A3132348BA96DF47AC3F95C7BE117392B994125145A2BB00110FAB76B2ACF0EB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330307, "uuid": "84769651-5146-468b-8af7-e0c1b91e2773", "value": "768:ITtlo+/JQ/4Yr1EykIl6u4AqSqCweqKUmS7/2MVphVbtoChvoDmfvcN21EzDyHfi:sQyUl4hToDEvcNBfyHdMknrR7Sd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330307, "uuid": "bc21168f-2ca2-4826-a008-9de5180fcc17", "value": 66616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330307, "uuid": "75591cb7-1690-47d7-ad65-736cdcf03270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330307, "uuid": "ce9c6496-4cc1-46e3-9aae-9e6b84c6fe77", "value": "main.power8le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2e46e0-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "ca99b90c-f228-4b8b-b5ae-8fb683c97396", "comment": "Malware payload (Formbook)", "value": "8af0bcc9247c4eefd6fcbc1a1150543b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "d7a34672-7d04-4621-bfc2-ea7e41984bba", "comment": "Malware payload (Formbook)", "value": "7c61bf50bf0a1ce3db1a9c33b2121b8ba0e9b6468acf839aed1cef6f7533ef58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "2415fc5b-8c6f-455e-a66c-debc601dc57d", "comment": "Malware payload (Formbook)", "value": "909f5b0152936cbe5bd979800c5b53511893a392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "81e7d854-2d48-48bb-b54a-57f659f3df8d", "comment": "Malware payload (Formbook)", "value": "0cf3b5bd16234b54760c5591298ad3d0a9fa40bd2ce3cf43a5c0be3a83ea0d8e11240635ad47f2052553d4c5338ea7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "c3e99ba1-bc04-4072-8f23-6a0549fedce3", "value": "T1FB35124422E9CE02D0FA47B05DB1E27057B43E95E862E3574FF2ACEB7C697125829393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "29203816-e85a-4f66-8538-fb1e65f1d9f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "582648fd-182a-49e9-b43b-bac381047876", "value": "24576:ORZkYeJaAyWoy9KdlzGC75u9EJ6NlF+JwwXQc/d:eZgZoAqlzf74EJ6Nl4JPXQc/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369098, "uuid": "64337008-7b26-4fa6-ac42-421645be01de", "value": 1143808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369098, "uuid": "0e2d940b-283e-4cbf-8db1-863885cb91ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "b830bd60-317d-4378-975f-2730f1c655e0", "value": "7c61bf50bf0a1ce3db1a9c33b2121b8ba0e9b6468acf839aed1cef6f7533ef58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74004f3-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "127ac415-5a12-44ec-9aa8-cd8dad4d9a52", "comment": "Malware payload (Formbook)", "value": "81952bafdec24c8e08236f1dd6a40599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "c8a4f875-7e54-4a42-93e6-b9fd905a5148", "comment": "Malware payload (Formbook)", "value": "7c999c8074100802e3b9bdc9857acade8aa5352b309cd5dcc40cf0142d357c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "8fb5f084-ccdf-4263-9115-2b918aba8bf1", "comment": "Malware payload (Formbook)", "value": "8daee46b16e62a172d7a3fafff2312fe62d80db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "d520c296-64ef-4ad4-8ddc-c3569abfc2c2", "comment": "Malware payload (Formbook)", "value": "1a8b421111999d6563942d7ce84ff17c34998b8cc19f6c4010181b0ac035d151499c42ee02e6043bd8c82699f6b13d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "529d57b5-1249-4143-afcc-76c00d81f385", "value": "T19C3512503F9DC821D8A26375DC75E3F002F96D8CED22DA175EE8BEB7757250268207A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "c9786419-a302-457b-a11b-2a3aa60fec79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "91fcd10d-146b-499e-b50a-2e7bd1d2b45c", "value": "24576:/KlCvgWPhe4Wu4p4m6kFndJ60rvPVSH1QHxdzpMgu6WjTBBiALoszMfif8:/KlCvgWPhe4N4pz68HRDNSVQRdSH7dXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370481, "uuid": "d53c8ff8-b0a7-4338-a64a-f83593a7ae99", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370481, "uuid": "bf0931cb-1ce3-45de-b7dc-6ded3040d30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "af29c3cb-ea8d-4494-8491-982b53c5c383", "value": "7c999c8074100802e3b9bdc9857acade8aa5352b309cd5dcc40cf0142d357c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5664f8e3-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786371070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "0f83f235-3c3f-4025-ac97-fc06d83f6b44", "comment": "Malware payload (MassLogger)", "value": "92cc23572e9535432bf32090b3aeb996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "3806bd71-b691-4a48-8fdf-dc02f140508a", "comment": "Malware payload (MassLogger)", "value": "7cc720d81f448c7246b761e0213640f83b099e564d32b08cd564a2462680ef46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "f65e8ffa-49fc-4fc3-b4c8-34dace620189", "comment": "Malware payload (MassLogger)", "value": "29b18f14448b0ed8a4f7a61035f680b896b76b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "ea046740-9d19-4fb8-b27f-f65759b0a45f", "comment": "Malware payload (MassLogger)", "value": "6b7e23d357d847bcd5bac1a401634590470c60962866797fcf9e0a2f83861b63a1a535f67172c7b14611d3f96570c7f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "65ba262c-6334-48a2-a4a0-822a2559d37d", "value": "T169F55B70D351B065D1A7C430CECA4EF4A4A1343B52366D1F1BC5D81A25FBEA1ABAD3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "33211272-761a-45ba-85b0-74903b6c708f", "value": "07af236ddfda722ba1d11114d888110b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "1ec49710-a8c1-4961-a5cc-758221f7196d", "value": "49152:HZpAWvseJw740jIhG60tSHwFUl0h5+xBn4TZ0ZZcP4wpFlhmD11Udr14nGFHgI:pdTHGTFuUYhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371070, "uuid": "1ddd31ed-6f93-4fc0-8243-73f2603239a4", "value": 3404288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371070, "uuid": "13b589c0-4a6b-4883-a6bd-089b33f1e6d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "fd0d67bc-f958-4f47-9663-1337b14211c6", "value": "7cc720d81f448c7246b761e0213640f83b099e564d32b08cd564a2462680ef46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e013c30f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "9b1d507f-8f5e-4c94-99c7-60dce877d722", "comment": "Malware payload (AgentTesla)", "value": "8814659f385137cecd007b99c364f6be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "7c03f5d0-9436-48b0-b90f-a402cbb057c8", "comment": "Malware payload (AgentTesla)", "value": "7cde3939faf4f2455e3423203e86e869764d39e78140e52b7acaf36ce4aed513", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "f4a98b14-1ff7-4146-8444-108455f23f34", "comment": "Malware payload (AgentTesla)", "value": "4e98fc700f8d3c2cf3a7273cee60d915aff05975", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "cdf057e4-f07b-4e3d-98a7-ade682448424", "comment": "Malware payload (AgentTesla)", "value": "3cd97b483a38937bc8b8ce3339204cd3bb82d18b3a0e9242196ded147a95fde46e4f37798548a459b92df1059fda8380", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "c608330e-7790-449f-aed0-ef8b4ac36588", "value": "T15C3501541342AE42D4D697F6BCA0D37032B45ECEBAE2D3D29FE52FF734293812954292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "1ca09016-1cfe-4555-b10f-872c84ba61c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "d40269c4-d264-49d1-8308-2574a962912a", "value": "24576:/Sr9p50fdx+pCPdb8fvNBLlWgJxb3znADbEFKu:/MpuFB8tNBDneQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373448, "uuid": "06a60165-b73b-4348-a47b-1eecc7f6fb35", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373448, "uuid": "7064e15d-b801-4588-8875-4e1645366680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "52fb66b2-082a-4e9d-8053-a6ea49c14075", "value": "7cde3939faf4f2455e3423203e86e869764d39e78140e52b7acaf36ce4aed513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35577157-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "947eedcd-dd1a-47c3-9fb8-3f701d5aed5b", "comment": "Malware payload (Formbook)", "value": "7059eb13b5798a72f35203d289c56ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "eefce493-caa1-4edf-a220-8b402291e11c", "comment": "Malware payload (Formbook)", "value": "7cf341abc47c1aff8deccb0f1689e21d98b29218f25540eba47af269e569f1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "4bc707d8-956c-4ba4-9ca2-d3d57918d751", "comment": "Malware payload (Formbook)", "value": "15f7508ea488267a2edaba32bc347087da87adce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "ec61176b-cd78-42c2-8e76-558f62779813", "comment": "Malware payload (Formbook)", "value": "56a9aeb2c7e14e747156d40bf3e781f7bccc40177ab6e215d9f9bb7128d78438ba3b3fd710890448703f74094ed02400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "a4ae75aa-55a1-4da1-bafb-6b0c70961a8a", "value": "T1F63501541316EE42D0DA8BB2BDB1D33432B90DDF78E2C2925FE56FF778193812958682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "f3a5cbee-cadc-4032-b017-70f302107c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "66120d77-d733-4418-b15f-b6cd6b9139ac", "value": "24576:cp50m34Zh+YBwH+xgAOg80DlHnWttRC1jBlTM:cpf4Zh3BwHrsVnWnRC1jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373162, "uuid": "6e9df1f4-e581-4c17-9012-df2d1e20fe2e", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373162, "uuid": "5dbf63bd-f525-4735-a083-98b73b7ed465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "06a7d8eb-19b2-4777-958b-e11b065c8af3", "value": "7cf341abc47c1aff8deccb0f1689e21d98b29218f25540eba47af269e569f1cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d314c50d-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "eca5921e-4a8b-4891-b864-2283b3f4b702", "comment": "Malware payload (Vidar)", "value": "6aa3e18f741881f8e0e3b80c3ffbfaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "a33dcaee-7dd9-43a0-b3f7-f866d698a5ab", "comment": "Malware payload (Vidar)", "value": "7cfba22038c53fb14719f65dbd7430938dd14012ecbbdd177c7d6934209997ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "4a82a803-c6ff-444c-9376-de88af1907ad", "comment": "Malware payload (Vidar)", "value": "270d5547c47236e269f53b8cec4c443d28474433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "fb32e6dd-234d-476e-a12d-e350d8c238b5", "comment": "Malware payload (Vidar)", "value": "45df7dce54b8ba72041872bf78e8efd7de7f8a83e322819142ba1f65347b0c177831072d4cab4c37d57fc9b78e62195f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "0e634479-6e47-4aa1-b45b-75ad92d85c06", "value": "T1A642E68B7392F1BDD418C178D9DDA2B7D7063085022A5B7FC9DC8E943F822507678A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "6f1774af-3852-48db-94b1-10bfbe494385", "value": "d858dd8b1bbeb55562e1202f74c59e9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "a7b79edd-ecec-4bb3-843a-c95c868961e6", "value": "192:OsH4+9rK7k/KqmQZGGreNq0/DGnmfTgw4ywM4jh8A3Vk4:OQ9rKwSVQZ5reJ/anmfT5KVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368702, "uuid": "73f2d2ca-70a2-4e9b-864c-5e105753ea24", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368702, "uuid": "52ccb0c1-e091-4ee5-8175-c270a2b6623a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "c7482259-786c-49f1-b307-7a8db9ba6444", "value": "7cfba22038c53fb14719f65dbd7430938dd14012ecbbdd177c7d6934209997ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de81c6dd-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "d49e1c99-f0ef-43a8-83ba-511ce7026612", "comment": "Malware payload (VIPKeylogger)", "value": "1d0403eaaf8fec8795453ada43d6e150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "36550f92-e2d9-4187-bb30-e625e453d142", "comment": "Malware payload (VIPKeylogger)", "value": "7d4267af13461285b1da029ffcbf1cae55d116347d3e9ecdf32dea20aa508138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "0c8ed05e-deec-4353-b87d-039d58eb5614", "comment": "Malware payload (VIPKeylogger)", "value": "a49fe6c9381b11a3eda960065dfa9b67806fa878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "3b70f137-8bd3-47a7-ab46-cb118ef4a087", "comment": "Malware payload (VIPKeylogger)", "value": "c555b848067b22245c44698207a90b7d0d7ae05808f46262cf54e7e7f167a4afb40c2e4b49239a313445b1a3bcebd51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "072dd4c9-5aef-4ec4-949a-e44501848f16", "value": "T13674124933E4D5A2D1B3497209F629252BB4FE493395671F17086F2DFE32A81890F2DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "64775c64-4ae5-4086-8e0a-7f0f14f78e05", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "92209fde-1723-4241-8486-501cb60aa8e4", "value": "6144:tXsKoGhhRZqLleCdJPP5PsotErMam5sPxzC40c0YtjMpXM24FpdVPVnSzX86PHd:tX9hRYlHPBVY/XZe4OUMpXf4FbMXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373875, "uuid": "d2ae3b04-ce56-4b70-998a-f0b7fd95e7e7", "value": 359168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373875, "uuid": "8bcb8a5c-3fc3-48f0-954e-ff541201aa40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "c7a48e7a-26fa-4100-be69-f625f6d61509", "value": "7d4267af13461285b1da029ffcbf1cae55d116347d3e9ecdf32dea20aa508138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd42fa6d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "1158233e-bb88-4f7c-9985-735c3f36dd10", "comment": "Malware payload (Formbook)", "value": "58aa3b168a9215ed72e0f4aa46f68c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "9571329c-39dc-4e96-bd30-5766d23ac95e", "comment": "Malware payload (Formbook)", "value": "7d4ca6eefe89648114310a5b13c0134976dc7975bd03a17cc5e397548808d037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "be4ee5e0-3628-494d-b6d8-5543075d31f4", "comment": "Malware payload (Formbook)", "value": "62f719ac7c1e43d6960c1dbba3ee490a50ab8856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "dacee14f-487b-4dc1-a0eb-702fb35ef848", "comment": "Malware payload (Formbook)", "value": "cb172bf17488b6668cc83346a8b843c448c90ef07644996b31f1144cbd56578d6e9b4384cb058d0ff30bde16c265b266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "82ba9aa6-98e0-42e6-a61a-04a5a9c23512", "value": "T17A3501551312DA82E0D68BB6A8B0D73132791DCF79E2C3D25FEA1FF7392A7C11954282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "cb9c0d6d-606a-44fc-acec-3673c6265608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "99c723ce-24d3-4f58-b37d-d17beff2507a", "value": "24576:l9bbp506GIx9sXid0dkUHxdNYXRNWazmyzX4:l1ptxydkUbNY7WazF74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373417, "uuid": "d5f823c7-9319-4df5-99e6-428e0de11a35", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373417, "uuid": "59a7b93a-f7eb-4845-a458-b2bf1a7129a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "260ec9e2-bba8-414c-a8e2-853dcfaff150", "value": "7d4ca6eefe89648114310a5b13c0134976dc7975bd03a17cc5e397548808d037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b8def0-949b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786353277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "42319d4c-a8ab-4438-b3cc-e073913ac891", "comment": "Malware payload", "value": "6186b6599f00bdb3eb3eff686dda9826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "9c218317-ed2c-4b6d-b774-2b6963403d9e", "comment": "Malware payload", "value": "7d59c3af2ee7b20bbe3acd3237e45f7662c31cee3d2b3c070c7715a799b0ed81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "cd5283e9-1b1d-4cec-8b4b-af9ee6ff32f1", "comment": "Malware payload", "value": "0d3a4077cce9c8c93ec8069d8c51615071a0aca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "9072384a-c0e4-44c8-a52f-0d8cac4db24c", "comment": "Malware payload", "value": "0b685378a23aad0e0e48f04a1ea81822270af94f22cd74caa073b146b8b2c168874a06585b3af8168a9bcd56cbe56392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353277, "uuid": "d8c10edb-1895-4356-a284-bafde9410115", "value": "T1FD968D13EC9155E9C0EAD23089729253BA717C486B3163D33FA0F3786E76BD4AA78354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353277, "uuid": "bdb74ea6-a77d-469a-b38d-cfa49b5e4210", "value": "98304:uTzOkbNnTSPeEz4q2e7t3adERf4tLFGMmQssAciz76T/YvT0Re01Ks9:uT7NTSPnt/RQTGINAcI7DTcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353277, "uuid": "47ef830e-2c23-4922-9696-452d68a4e699", "value": 8804382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353277, "uuid": "cf727ea2-f57d-4cfe-a14c-30e996a56bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353277, "uuid": "6c213480-ca51-4a85-bbf9-57920eedbfa9", "value": "jenload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7210c30e-94ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786388296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "b89d9bff-8c5c-4ed0-b658-3d7eb43df588", "comment": "Malware payload", "value": "4b29a0edf69bdbd712f85698467853d5", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "0d53b1eb-bfe2-4fcd-829f-5b9eedd4d7fd", "comment": "Malware payload", "value": "7d8b4974a69380dea474217119954968f3f4d1addd9b60990ca4615cd6cad024", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "1b76b9b2-7a6e-4f63-a51c-acff8fb24473", "comment": "Malware payload", "value": "1e29a77696592809c267b02885c3421cbbb943bf", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "9b72e062-d5c8-4658-9d62-a3778fdd9389", "comment": "Malware payload", "value": "b3f0ddd0970a165cc7801010e1644bf167b66a2fcf8f81959383b6840095e99d1de9078ef0c9fae11907783d782ec96c", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "c91e6483-c303-4ae8-b353-1378d1b75c3e", "value": "T1D757E7EEA0DBEE5DE410A634A754C44C0C7BBD5A3B12981FB140B77C9236F5660FAB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "0003cabc-6245-439e-8cbd-68d1f70e2a3a", "value": "2e6218167fe732516646f6c8da39c0ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "a18d6a23-771d-4ba7-882b-988c50f912ec", "value": "98304:6caYfW4p9D99KjAxqehFNj4RlubZRLBGnTKse6DcsfMZK74mPuaDyW0CD6Pfrwe4:HaYfW212ubDQ9mRZlLFnL9DiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786388296, "uuid": "6a9fab58-2900-4c85-a839-4c830d29f8cd", "value": 28152320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786388296, "uuid": "17211cd0-5fcd-4a7c-8cc0-6162bc738e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "e11db5b0-8843-4538-a3dd-d5bb6b6772a2", "value": "Engine.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb497adb-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "d559b254-204e-402e-80bd-237f9213b467", "comment": "Malware payload (Formbook)", "value": "12345804a50b7dfc72ed7920cc493233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "ce8ba37a-65b1-4c25-9750-b72e96a862fd", "comment": "Malware payload (Formbook)", "value": "7dbefbc7163ff38b3a08f73689cdfd0318018854dac6c1640639a7ba50adbad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "7b4523fa-4053-4b1e-994e-1cf705099cdb", "comment": "Malware payload (Formbook)", "value": "b2b8bec330613d6c56a1832dff59394f5d982d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "84b8635f-3fc1-418d-b164-ad1c87d5cfec", "comment": "Malware payload (Formbook)", "value": "a52e4d5e1a5912716ef9927c3352bf6632dd07096b7deff7e677b152e77e0ba145f22fc545f11e424780d96e4f43dc1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "b53ae0fb-5830-4d55-a294-9bac56907c52", "value": "T1FA352224969BC923C5966B72D9E1E2B013A58E4DF213D34B5BECBEE7B8333871452341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "fa998f70-653c-4983-83ce-704c61a4a643", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "963587e7-5158-4dc8-804f-a0b0533e2133", "value": "24576:+RsCbEWmM0UOk5qogfEobyG7Rh+LK2ilzUoI1Ah9dKwiGotEZYIxO:ATJ0JogfE8yGKW2ilAoIO3dZEEZ58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372206, "uuid": "c88acf85-6615-47af-9a90-6c0a7629b5af", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372206, "uuid": "013558b2-87c1-4fa3-8764-c1baa7423ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "246c735b-89b5-46ca-9f7d-53254f397674", "value": "7dbefbc7163ff38b3a08f73689cdfd0318018854dac6c1640639a7ba50adbad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9083b5-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "e90e102e-c6ce-4da8-acda-eadadf561e21", "comment": "Malware payload (AgentTesla)", "value": "d0dda77051593099b45df65ec0704de5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "5dcfdb4b-c3c1-409c-8f2d-71f1e39f595c", "comment": "Malware payload (AgentTesla)", "value": "7e3ac5d4a03da314042ab3d2015918751558676c0ae50af1121560080a304e84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "f81b0c9d-e72a-4c87-8788-3e8f9e729bbc", "comment": "Malware payload (AgentTesla)", "value": "d88d9c27466c4000b0c737c14329089cdffa2852", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "444364ae-5635-48df-b7b0-5bc423ad31b0", "comment": "Malware payload (AgentTesla)", "value": "b8c7a20987493de95e0317b81f4a1009d07777f96f952de3b496412aedae2c13e015d9e901a0815c4def80c0d5ed6afb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "4ef5a784-07c0-4e53-bdfb-f16c49af3e7d", "value": "T1CC25E01927E85B68F9BF9B79447805114BF6F806A773DB6D7D4840EE1E22F808A42733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "74dd7f06-f1e7-477f-8794-3ac6822f129e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "980b1d31-efaf-4b38-a893-fe86d3e27698", "value": "24576:LOC1gyncn7oprP69WQXy43iEZ/PPih+e4gFhKvQFOL01:3ckZiri43iGiMgF0sOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372186, "uuid": "4929eb07-578f-481f-b11e-ac9c42f6a984", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372186, "uuid": "22f46944-f171-46ae-b117-c4c84091dba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "0587db96-7bcc-4bbb-be7f-c92ddf3d1bf2", "value": "7e3ac5d4a03da314042ab3d2015918751558676c0ae50af1121560080a304e84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15a2fa9-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "d040b066-3c3a-49ca-9b5e-64530e89142d", "comment": "Malware payload (Vidar)", "value": "e58b7c4357e53a5892aaf0ca2ab0a2ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "59162287-bda1-4f62-958e-602ae30562cd", "comment": "Malware payload (Vidar)", "value": "7e490d8ea84c74a17042cd9b343584978ae1f1fb448509367d5d1ae6e2515c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "ef43b34c-6454-4b67-89e3-cd4004b6f4e3", "comment": "Malware payload (Vidar)", "value": "2808bff452c9744e3e564d5e03ff574006c65956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "9de95ff8-f9f5-48d4-8f77-0f3a04f3e73f", "comment": "Malware payload (Vidar)", "value": "45909ba8a939c3c8807e867f26fff6857c052833a33189818fe72cdb6f807f67752eac35eaf9b6669bd312d7b5984b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "d805f147-fc00-411b-b4b8-05563e08df2b", "value": "T17D5207CF31A260BDD0B9C33ADBEB1AF6CA66304516166FFF46ECC5542B4351029BCA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "b6969e5a-d135-4ae5-aea8-1d339b22f1bc", "value": "a0e569ced2b379a4afc970642c7a53ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "28eb2931-3705-4e93-9954-a62940b4a7aa", "value": "192:ODVlUV+Aa3DVIRXbFZNURVhXBw0PrSehXUosdA55FanG9HY+fz3VQu:O++A+DoJYTJqG940zlQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372108, "uuid": "acd0f400-ef0f-43c7-9d20-c139944a8830", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372108, "uuid": "8581dd91-4f2d-4f8f-8a9d-114c787050da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "2dc9dbad-d924-4002-81ae-351fc72c6db3", "value": "7e490d8ea84c74a17042cd9b343584978ae1f1fb448509367d5d1ae6e2515c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32eb53d6-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "91261f4f-c001-4bbf-a78d-2d1cf13cc774", "comment": "Malware payload (Vidar)", "value": "b42f91c93926dc64a227b8f44fbc33cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "158e4645-959d-4b8f-b357-c87ccc18ac46", "comment": "Malware payload (Vidar)", "value": "7e938d2be8198c194649447ce409f5e05bcf498350bee69c5867aded464a430e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "2e240bfd-56ac-45d1-99fc-3e646f1bb6c3", "comment": "Malware payload (Vidar)", "value": "04a0f2f1b8411e0dd09c8316df83b37a7c7491c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "a02c90c4-a1cc-48c8-9870-b42d967e0af8", "comment": "Malware payload (Vidar)", "value": "5a833255760d2fcffc8296bfc56d341a322b94a2a763cd7ab39aea66c97ef46743dc3cf7fd868695a0850388b0117a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "15bc8422-0465-4386-952b-0677986c879e", "value": "T16F621AC6B09370A5D0B9C33ECB1E02E79AB6305607376FBFCAEC4594268352175AC762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "e6377b25-4669-44e5-bf0c-16df98265075", "value": "b94dba3155137e594dceb5b549504f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "3fb1e2e1-e2e2-452b-b9dd-bc1189211551", "value": "384:iM+v4jgXLqeZdJrLN6wZOw6zjWxPFEkJadGli:NK4UnJrjO0NEkigi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368863, "uuid": "b50d2d10-900c-4866-9837-e2b179052d4b", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368863, "uuid": "ba747f52-3531-48ce-96ff-c959bad1ada1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "6a5fd49a-590e-4ba2-bb63-14e23a7c8292", "value": "7e938d2be8198c194649447ce409f5e05bcf498350bee69c5867aded464a430e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5457360-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786368330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "616f0853-db4c-4ffb-aea5-7f8ad9973f7a", "comment": "Malware payload (AsyncRAT)", "value": "d20199e17a8b82f032f552babce01188", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "058fb519-2e62-4476-97c1-e2631ea8e2ac", "comment": "Malware payload (AsyncRAT)", "value": "7ed128f60606e48e519f0da9d8f412944e13bb24b7f47e2a8222ab84dd7e6093", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "ac24a39a-a9ce-4083-a9d5-9998398b9c26", "comment": "Malware payload (AsyncRAT)", "value": "55e4eb933dc40106a31210ec879daefd5ebbaded", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "db97342a-a4a0-4e3b-86ed-9c67c5b6a94d", "comment": "Malware payload (AsyncRAT)", "value": "2bdf61eb3a725e86071b91f1e56221821a6e874ad7deb21f3f88c08e33e37cb14de96f79a04b49c660f21e4309d48f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "2b5b6163-8b0e-4b81-a5da-2571706ee2e8", "value": "T10E05E0D03769BB05DEB41A359A75EEB543B92D68B424F9EA1EC93B87746C3009D08F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "c8baf1dd-acbf-4451-9d0f-cd8d56823180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "7c22361d-8cbb-4edd-a84f-3ade09e23370", "value": "12288:lBSsGy9Zj+2y6wo6QviA5SP6xYInUQSTkvGHt5XU7tfUamrmD/PN:lX9Zqob5SP6xYASTkvGNIlTmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368330, "uuid": "75647822-a22f-4816-a29e-7309a0d0500f", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368330, "uuid": "3c539d90-29b3-4fbd-a982-acaa4ddc5478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "40f050a7-d158-4f0e-98b7-9179c3384e27", "value": "7ed128f60606e48e519f0da9d8f412944e13bb24b7f47e2a8222ab84dd7e6093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ec03f8-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786345975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "6bb796cd-65de-421f-b60b-fb35191f02c8", "comment": "Malware payload (Formbook)", "value": "34811e91378f09d0434cdb184be90fc3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "79bed86a-d026-49ee-9830-2d4c6d651d43", "comment": "Malware payload (Formbook)", "value": "7eedcabf7e36a3967453ad9ce0ae52dfc0098193fb6ee164bff8a79fa9038cf2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "dbb96d7c-0789-41df-95ff-29b7fac64cba", "comment": "Malware payload (Formbook)", "value": "12fffc768dfe68fd2bf3c8c9cfe3a56998301b36", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "17edd4b6-2271-4137-8bbb-91258bf30ae9", "comment": "Malware payload (Formbook)", "value": "23953296f52937106a12268928e427bf64cff9226f563c5e0d7b75fe2dbb8c4df7db3103260634281017b75e992b582f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345975, "uuid": "e9646b68-42bd-4b2f-a1e7-806e6e927a63", "value": "T1BFE52980974895B0AA2DA72CD1379E240A1FB04361C5EF1DB67C7A4873A6F5F638DCD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345975, "uuid": "e0662060-7949-44c6-bd56-6c4835be8a86", "value": "49152:VoHkPgiQciRQ+EOHIwZnVMZ+lbNgP3Qk4yJ1CzjZEDQZuVpYa9m7CNKEUWMzCAak:VoEPXGq+TIZ+lbNgPAk7J1CzjZEDQZu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345975, "uuid": "38d9eebc-dfe4-4401-894a-d4baf9bc8451", "value": 3090730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345975, "uuid": "93437417-d805-4708-aa91-f9bf8624d1d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345975, "uuid": "299404bc-1829-4cc3-9fc5-61135c3e062c", "value": "XScan09082026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d20e8ea-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "b9f8d4c8-2b8c-4b32-a893-22de7803c240", "comment": "Malware payload (Formbook)", "value": "c094b336c141a5f548d2174b20e46980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "92fb64e2-38a2-4925-9ca6-9ddacab273e7", "comment": "Malware payload (Formbook)", "value": "7ef400cb3e8277e921f82937f2abc8267b30096a150c706a6891f26d4dce50b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "23e07de2-2a2a-45dc-92ae-be6ba61839fa", "comment": "Malware payload (Formbook)", "value": "4b04cf8321f1297daee321bc6da1a0fff50c5bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "389cc111-a59e-464f-8d11-370416ddac95", "comment": "Malware payload (Formbook)", "value": "2892762a4e37b522564be91f4bb3309ef82375e294ff081f3c63b1ccbc2b6f00a9eaa81e8294f01e44c56a1978bedd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "64c7a271-d981-4bda-97fb-2904b5ee8e9e", "value": "T12B2512A4AE0ADD21C9935B74C9A0F3F512B54E8CE910CA139DFDFEDB7C3A41B5818582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "25e49d16-39aa-47ce-9759-092a5d83fc67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "c44f6f12-78cb-4014-852e-17e8596b6e14", "value": "24576:lpY/5gXYo8GtdOxQUWFWKCEn+yY/t5zwzsv8TCH6/pe:lphYCOx0Ywn+R/Dczscw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370330, "uuid": "82425260-1d9f-4b8e-8f76-45ba5cbb17e0", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370330, "uuid": "f010066d-a129-47e4-ac92-7b3e60b8712e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "db308733-8145-4a0a-8fda-435982aeacca", "value": "7ef400cb3e8277e921f82937f2abc8267b30096a150c706a6891f26d4dce50b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26263a52-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "a9f8898f-4a12-4835-adf8-feb6d1779ce5", "comment": "Malware payload", "value": "9cd31d75ad633e646f028a9da3b4307b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "5932a1aa-8245-4c2e-9d20-d7174b10ffb8", "comment": "Malware payload", "value": "7f0010cb0fa3f2a8402ee436b7fa464240cf77827d1e71197ef8e24e1cb17418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "4c0bba80-4f01-4f28-9bc6-d6057a600661", "comment": "Malware payload", "value": "d060b3863e39437bcefc179badbb7f6ed17f6ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "ef0174e5-c0c2-4d52-a050-5bbbb924a66d", "comment": "Malware payload", "value": "e6c72322bb759b03044d868459b3ddadf0a393d5a3f433c10f58a35de8a04f4a01da027c3de8e97dece058e9f4730ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "2390d6f8-379c-4ee1-8318-d9a5aae895f8", "value": "T1699412680D4541D6E254813E114F06ABB874C8959BDBB9E37DE7F033ACA8BD72D70AE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "598d6f9a-de18-4894-91fe-dbe64e7095e5", "value": "64b1a2d70787bddac00e22c6a90626f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "76da1f05-0222-423a-bde9-82249e900889", "value": "6144:SPMbFMqstTwOTBKCfk02xwimYeomuAKJUzi8VKcNSRdzsBco:SYFMqI7KCgxnbeocpNCz4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368412, "uuid": "26fca0aa-8628-45ca-b005-85bd798b43ea", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368412, "uuid": "093a263d-7e0d-4578-ac33-21e2e4b61e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "4651c596-0552-49a2-aa10-78587578e0ec", "value": "7f0010cb0fa3f2a8402ee436b7fa464240cf77827d1e71197ef8e24e1cb17418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09158be5-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "b826510d-dd56-4b60-9727-f4be246368d6", "comment": "Malware payload (Formbook)", "value": "abbe775e6b0e3466de5e380ef4dba4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "28f25dd9-2615-48d9-8221-0c631a9c3264", "comment": "Malware payload (Formbook)", "value": "7f15f5aff1d1265727e043a758440029b6fc3d52e2a3ba748916c86575f886bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "46680495-229f-4037-b0a4-b0125a066dc0", "comment": "Malware payload (Formbook)", "value": "7bbb78b86b086d17288b37f98271753b2e776a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "dc3674ff-ec43-4ab7-9183-a02508c3a496", "comment": "Malware payload (Formbook)", "value": "196dc16e82e7f3cf886963b3bd26d9e86fb88488347d7e4efe17b70bbda3f5beea5c3773aa6230645a21b7469c636455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "9d9e69a8-1060-4b0c-9839-306cd9cc7cb5", "value": "T144252268A617E90BCA19A3380BE2F371277D4EDDA500D2239BED7DFBBD65A008C405D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "3e9d2228-3005-4c2e-aba7-6cfb20aa51a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "b67f87ba-0f79-4863-80a8-166b2dd7efbc", "value": "12288:TlJdbZ9G4B07NBaS429soQHRTv2f+DexCVpSGrQBDx1b5N+zyUl5fDeIQ1oVOBQt:TIG0xwDGs1ZCvCjQBpN+zyHhQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371799, "uuid": "043c54a1-2c6d-41fd-af47-e13ca3dec7c2", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371799, "uuid": "38894bf2-7c0d-4c29-9e0c-00d6e2054e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "1615a2ee-8ad3-4c69-ba32-4a83c1e8f6a4", "value": "7f15f5aff1d1265727e043a758440029b6fc3d52e2a3ba748916c86575f886bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f638e91-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "0858aa6b-99b1-4da5-8693-4d183a4cc977", "comment": "Malware payload (AgentTesla)", "value": "3907b8303c170ed6688ae210ada0fce7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "92af223f-a0f3-4504-94ac-0eaac6af0ee9", "comment": "Malware payload (AgentTesla)", "value": "7f3c03d419eba8e6dcacd203e3285496cd13ef5f26a88e6d744c16324c6d4307", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "5843e737-5aec-46b6-869d-3c1f18b6985e", "comment": "Malware payload (AgentTesla)", "value": "d5a56b545e5c37f03cd2249470b6d75d0ba4f854", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "0d6b33a4-9116-49f1-b05f-09389a4ac6dd", "comment": "Malware payload (AgentTesla)", "value": "1cb77e846263e829afe3f7ab0e52d94cacf7ab02c0e19bf425d3cccf2b0a1e6e229f78008537dbec218d711d38171071", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "85b79bc8-0554-46fa-969b-7f03ce6f8bca", "value": "T11CA4F1057B00E412D6674336486AD7B40770AC619E6DDA5BF38C772E3BB33969B1A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "f6146a3e-72f2-432e-9be0-574629bf6c98", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "8069fb62-ce92-4b25-909b-50323f7fa321", "value": "6144:afY+onBfgb8Cid567+Px+1Z8MeW01JYIyVeuV2inqWnGH6shirKDGzCW5uJ1:afYFFn0wx+1mMxP/e2ja6shmEgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372884, "uuid": "846e95f0-73c9-41f3-8ce0-ed783ad2f7ff", "value": 477672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372884, "uuid": "6ad7d809-ab65-45a5-a51d-2e580abcc42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "4422404c-0b82-43df-bb1d-5f68de8635f0", "value": "7f3c03d419eba8e6dcacd203e3285496cd13ef5f26a88e6d744c16324c6d4307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bfb425-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "088cf588-5f8d-4768-a5b1-16f7257dae07", "comment": "Malware payload", "value": "4aa6adb760de342fdb7d03b5329002c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "14889c42-3829-4f20-b362-8ba1bfd08283", "comment": "Malware payload", "value": "7f7c6902723ab6dd3d07d7fb1e20fe4cb3dd7cf3ede2c143c633f40e777f3816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "a9324c0d-d45b-4823-977c-0e0c9a425c2d", "comment": "Malware payload", "value": "680aa0046fdfbeb1b334614132c07c82532a9830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "6b8b1e9a-b59e-47aa-ba05-69b8774a6df2", "comment": "Malware payload", "value": "3d59a7f71cccdac128d11792c2f9d116fdcd561583058611be53d905a8abebc92f7f5345710fa622136a6d536ea9a1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346371, "uuid": "4998ce21-d38b-4536-a977-73df2933e2c2", "value": "T16103F827DF62F42ED04A92B15BDFA6219A23F8FA0332A0069395FF715F454C0EF95252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346371, "uuid": "23d8133f-25fc-4223-bd78-77c4b69da58c", "value": "768:ye8xN1xMRDWQ28X5lqDxBwM1aVMrghnIt+8VCvqiIkw20Jr09:xGN1xol4wLGMnN/vTw20Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346371, "uuid": "cd8019cc-183f-41b6-ac9b-dfaa9b3ba902", "value": 39640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346371, "uuid": "057b220e-1d02-43a1-b53b-4dcd53cd5cc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346371, "uuid": "8ea4b78e-a80f-413d-8881-7417ad2a231d", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15e8f01-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "bdcd1300-f286-4445-81b2-5ac403eaa1b9", "comment": "Malware payload (Vidar)", "value": "51e1a4ae6f00c790e8d29b8de352a3ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "c9cb9d3f-dc94-465c-bed1-d446f2250ed4", "comment": "Malware payload (Vidar)", "value": "800f0e436047e2facc03243f47bed1e946fe8b55d67049ec4bfc4c8d9323654b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "d64e73dc-752d-4681-b69c-90bd28a15cec", "comment": "Malware payload (Vidar)", "value": "8486cfc065d7b15f2b88162fd16d97c4ff04f0d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "eb50044c-e31e-4a55-a1fa-75bd60961732", "comment": "Malware payload (Vidar)", "value": "9e722eec23795759e80e959d4ee58324cfa9da1d50b7cc8c0bfb8e1c48359107917a32d967a7ef062e2cf238ff688257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "39195edd-0630-4e3e-88ab-55a46bbb10e1", "value": "T18C827246E25B52B4C8EBC337535B552715F8B8412236AB3B5BEC9A704D52370FB282EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "4467e90f-949e-4fd5-af3d-927f9bc4cee2", "value": "b94dba3155137e594dceb5b549504f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "9afcb0fb-6191-4484-82c3-38f4d3feb60b", "value": "384:1Am0nsxTmmkRe+zDri2+u/nt8VHAdTXPMyBOclG9ZliCO:BqRtbiNuEghXvs9iCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368323, "uuid": "2118fa29-ee6f-4b4c-b1ab-ab3337fcba96", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368323, "uuid": "ee843274-8621-4600-941a-1d8d7f228506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "ca6e9f22-b96d-4fa2-9a38-bf1472021d0e", "value": "800f0e436047e2facc03243f47bed1e946fe8b55d67049ec4bfc4c8d9323654b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc88d5b-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "385fbb61-fd82-4761-902d-8f8572d7b6a2", "comment": "Malware payload (Vidar)", "value": "8ac65348b7dacab82a5063e01017222b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "780f8cfb-270b-4372-95ef-b3fb1b536dce", "comment": "Malware payload (Vidar)", "value": "8027988f209981c0e76552bf626212a961117c0f233ee71fec490304b69270a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "18ae69d6-b232-4d6b-a66c-d19c07bab152", "comment": "Malware payload (Vidar)", "value": "a6799af46b0454d5f9e709647e77c21135297d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "981bafd0-ab5c-4369-a143-289854f07981", "comment": "Malware payload (Vidar)", "value": "3bd67a5a2906309e24b68b60ca4685c4e1da84fa1b634b137b9c78bedcd63d55c0ab792d82a214798737c97a0ce9a253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "2e349753-07aa-4c88-bef5-7634a01d3247", "value": "T1B05219C731D271FDD2B9833CCA4666BAC7733082032B1FFFA9ED89943A9251525AD611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "87258080-bb1d-49fc-9316-06c6fc586c7e", "value": "1d01a4090e36ef1b5c2376910836a381", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "fd6566cb-25de-40a8-baf5-3c05b27f6637", "value": "384:OCh4X9Ena1+Se0Yn1xsUEpMcibmbSLJKll4:0s0csTpJamWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371139, "uuid": "8d439e02-1b3b-4b69-ae6d-d100f307ae2b", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371139, "uuid": "0fd5a1b6-b1e5-49d5-ad9a-cb7f9a264c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "62efd18c-4d81-489b-8eed-a26faef2f1f0", "value": "8027988f209981c0e76552bf626212a961117c0f233ee71fec490304b69270a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd93d3bd-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "69610a96-7ddb-4e03-8fd0-71e230f21745", "comment": "Malware payload (Formbook)", "value": "c8c1f264c90e992f8b729a82c15c3aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "1ec96299-2afd-42e6-9a3a-f3f6e6bee571", "comment": "Malware payload (Formbook)", "value": "808e5128540188f0345be602798bb90c6764cdf74ffa052e6a8c7d6c0f988e7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "35e61c91-b335-4abc-a136-e02b48ff59f3", "comment": "Malware payload (Formbook)", "value": "b5766265b80cccb7a65c7be0c10c03421bbcb180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "d7db9cec-767e-4d00-9470-5e28dc3d9111", "comment": "Malware payload (Formbook)", "value": "e867b1325d3d6ae27d5bc48f650693ee3b9b0a9486beb0977c6525327b01db97059a05391197c7ec30824a5a7baa04ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "b7ee8528-796e-4346-be6a-d1a741f5a115", "value": "T19A2512694729DF06C5964BB049F1E0F243B56F98E426D3039EEAFDEB38363661818343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "570a9bb4-4610-459d-9338-5cdfd2c0aaee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "331b7501-ee18-489d-97ff-a94ba0737272", "value": "24576:Pj/Og3BL4bFSGIWXODrNTyzD3BnZdzQRh6G4xUK5huORW:bPxUbgyXMgBARh6GPK5AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372129, "uuid": "378c5e67-d7c1-4c11-acb7-cb4e433abf92", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372129, "uuid": "c9c84f22-6560-40f7-b7c7-809f70a8e94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "510c600a-2e45-4caa-8110-6a2fe8584071", "value": "808e5128540188f0345be602798bb90c6764cdf74ffa052e6a8c7d6c0f988e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df047bd-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786374062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "c67820f5-99cb-49c7-9bf3-a69c70da9fab", "comment": "Malware payload (VIPKeylogger)", "value": "71fcffd0c84c491f38b62710fb721dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "a9c70946-0889-4ce8-8743-a7968e647d57", "comment": "Malware payload (VIPKeylogger)", "value": "81617153df10cae3b6d457872a32b4a99c1422c371f225a2bcdaf1f08a1ef563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "c51d09b3-f7e2-49a1-a25e-c33bc073b525", "comment": "Malware payload (VIPKeylogger)", "value": "d0617972b76508a76ac094d69d37213bf722be6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "99514841-ff3c-404d-9d85-89a440968502", "comment": "Malware payload (VIPKeylogger)", "value": "ec9d468d9c18f0d44a5e6e5f2a5902fc46451e9edf45372ff780fde7a6498cbe3e2991c44cafa7f9eb422f381fd6a320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "ab6251d5-2662-40ae-8f58-b18a9b63f6f2", "value": "T16735F19C3601F48FC9478A358EA4EDB466146DBA9307D3039ADB1DEFB90D997CE041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "7d7f69dd-57f8-4835-82ee-453de06b0f55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "daa212a3-7c5e-4d4f-9417-03fe5d47d12c", "value": "24576:24eA9sLJzbLcEXSTGj72aWGXI5L7Kw0H3w:2hUsLJzEE7j72aWGqnWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374062, "uuid": "3e8d579f-dacf-401b-afee-9e1753a4e9bd", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374062, "uuid": "a043581e-ec2c-479c-8064-5d3d5209fcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "63071f18-5c6a-4e73-8e3f-b5df147a27f6", "value": "81617153df10cae3b6d457872a32b4a99c1422c371f225a2bcdaf1f08a1ef563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5388648-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "4dc79145-0b58-452e-b404-da51c8c79501", "comment": "Malware payload", "value": "25b88362ca18c877ffb38e3d711ae479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "edce1b06-0407-48db-a4c0-1f2e2a0b6d56", "comment": "Malware payload", "value": "81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "5a54a9f3-68e0-4249-a816-7c08b3812aae", "comment": "Malware payload", "value": "dca3709b9f13ae94e072700b72af4c0c43b35238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "665f6458-5364-4379-93fe-63e213e537db", "comment": "Malware payload", "value": "2c3e111b7042496fca19f5523b5799cefaca295b108b37a8e7141b31c705bd6617b60307e3a0676a5dd3f3ce9c260229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "bb5715ba-c132-4c18-98b9-45f0ab69678d", "value": "T15904020977C0C07AC69396300EB6CBFAE673E76406291B3B2744AF6D7E702C1DA09795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "394caabb-6356-4340-b381-2cb526d193d4", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "d34c96b5-60d1-479a-a5db-0535d6f6f3e7", "value": "3072:1LfVxlyEZfp9zIb45zUT+T9B6nGhtGh0zXBlKZiu8ow6zudPM+ku1:ltXZXcMjKGDLXy8uUwu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372517, "uuid": "7c716862-74f2-4f6d-b146-c2c234aa7b9f", "value": 176623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372517, "uuid": "89d21846-6791-48d1-b87f-444d3456b4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "eee0b34b-ac24-4a66-872d-9efa4e2588cb", "value": "81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd98ae5b-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "ed2257c8-3b5c-4d5f-8c2b-67e270922c67", "comment": "Malware payload", "value": "59e7dcd3bb188208dedee13b705c5b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "93f59947-b816-44a7-be53-831342dbcf36", "comment": "Malware payload", "value": "81c48742cfb6e74f027c5b4a3a4cedaf6ce524d29ea61ee8aa021d04fd0f5024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "9e548211-9734-4c62-9a68-24004d98f550", "comment": "Malware payload", "value": "6c704dc9863f8862f70b64f5cfa59a7ea3e78548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "944e333e-459c-413c-8b1d-4eb94d86d4e6", "comment": "Malware payload", "value": "a886adadae726a1573c90f654cf38c4384b0484bdb4b9ff53cffec4d2be531a95192cfdda5e635c318b026fa8e2ee7bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394865, "uuid": "fe2391f6-e49d-49f6-a209-e1c16c62370f", "value": "T19FD31A05EE047ABBD09E8E7845BFC19204D53DF7A2D4833976D86A8D7A3C65906C3B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394865, "uuid": "53b3889a-0f7c-4fb8-9090-62650d87d9b5", "value": "1536:L1C1vQgQe41Za1UO3b1c7wfJLXI5PMErecDHh:wigf41gy7uc99DH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394865, "uuid": "a356a1f4-30a6-4705-863b-362194564554", "value": 140260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394865, "uuid": "16ae917a-a10e-4e6e-ad3d-cf5feb7c79f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394865, "uuid": "d041d6d8-015d-4e10-b112-d8a48228f1b9", "value": "main.mips64r6el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4bfac2-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Genasom)", "timestamp": 1786373549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "ed84da85-7ee5-4d93-a959-ed78e18e4083", "comment": "Malware payload (Genasom)", "value": "fa0913bfe83efe092998da70975b5918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "b4d07b7a-a178-4fc7-b17a-07791c11d636", "comment": "Malware payload (Genasom)", "value": "81ca5fc6b55accdbc44266d66bd72c7c4152a75b215593adc433d51250054333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "27c86f91-31c7-4809-bcc9-cc07dc477ce1", "comment": "Malware payload (Genasom)", "value": "bd33c151352ac50abde82d9e5fdff845f5c77710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "8daaf876-4545-416a-9a8e-0acb9a82df93", "comment": "Malware payload (Genasom)", "value": "63e7ef3a16d98279fa9d066872c3abfd2d19a8084a6c7427caa9d97d9e34b43c40aa616ddb28ded2c443798f6f14c62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "e37f6fc5-eaf5-462d-998e-0573bb172460", "value": "T1DFF37C5771E276FCC116C034420B8962A9B2B81D07216DFF229ABB342F99DD16F3DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "f23d8b05-1689-4be9-8c14-a90d52f64a41", "value": "2a18ed1f0638874d776afcc7d7079aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "763f9fd9-8e6b-4c1f-a682-af5c9aae317f", "value": "3072:1309S0CIpUOJQAjXJaDMVJxAQWroYGzQoD:UTX6ENVJxAQWMYGMoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373549, "uuid": "b4941951-9940-42ed-9701-df0ea7b30e61", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373549, "uuid": "5871c32c-504a-48f2-a99c-77d93c62c1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "a28d9b3b-1542-47af-8b26-fab7b0b31a1a", "value": "81ca5fc6b55accdbc44266d66bd72c7c4152a75b215593adc433d51250054333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e12b2c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "a85899cb-f446-4227-b1d9-5975e8306e3d", "comment": "Malware payload", "value": "10fe54ac8037949805cacc1534ef665b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "36c8ffcd-7a74-4884-b4b3-e836afa475cd", "comment": "Malware payload", "value": "82b06ec2d0a6835c9436e03fefc7c0569261fa7241b067a8ca4decbe5b951146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "4054d037-3640-430a-953c-1252cb28551b", "comment": "Malware payload", "value": "8dfe74126904adb21bcacccdf7f1bde6d2db0e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "7923b054-3009-4d21-b37a-973979327ac0", "comment": "Malware payload", "value": "b3d63b9c3762f620efe75db1880640a43c96f447abe919f4886f3f7b790dd4ec1e4d832943d0ad93e2b13c2553cb9a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "7bd379a5-fb05-4a0d-bb32-17678a899a1e", "value": "T14345F11913E4AA68E4FEA73197B4001147F2F80B9636DB1E6D4C50EE5F32B819967B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "9b0d808c-ae27-4584-a173-6bd2395c4f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "2ec6d18b-594c-4690-8b18-06b917f55353", "value": "12288:Qhbj/T4OFyLHK9Jwe4ezKWusA8Z2vjtxIcYzLzuZeGRpQ6s7Ew7z4RH6qQx:IEOF8HKLZ4e2sAh8cYHJiKhzyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372493, "uuid": "bfbaa139-14ee-4941-9e64-ab4d54dba910", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372493, "uuid": "4f00b303-0fdc-49d7-a753-8fab5190969d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "87abc52f-22b6-4823-84cb-975baa18342d", "value": "82b06ec2d0a6835c9436e03fefc7c0569261fa7241b067a8ca4decbe5b951146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475866d3-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "8d25595d-f05e-4060-a732-80bc2fe4109d", "comment": "Malware payload", "value": "f7107fe8a1d922ffcd00dac36ecac3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "759d524c-b460-4383-bdb4-1e50200c616f", "comment": "Malware payload", "value": "830a22ea4eb2ebb8c60c7731fa5175d3a315d023a812aea40147326cc4c8a4dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "34269923-28b5-4b4e-a93c-2ea8f6ad560d", "comment": "Malware payload", "value": "e86878e09b9c24c66b65bf8068ce8586be9b8dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "d172ad61-8064-4eb5-8014-4d582403c713", "comment": "Malware payload", "value": "890a2a23b399e035b46f3b224e896ab3d4d630ec76fdc92e61eec58ea9c3e44e4f5903e9e33f5c9082793c97fe542679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "2ea2361b-f05d-45fd-90f1-1c37d496353c", "value": "T118B6233BF15B653EE06D1A3A3A76E150993BBA6165124C1297FCF88CCF250700E3E697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "f1a8d7fe-8dab-4ba0-ac26-46382d9e1f6f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "efefa094-103c-4859-b6b1-c00825aa0802", "value": "196608:cyigH4kiY48zSXR2iAMT9nfE8G9R4YaHF39msUI5Otn68zjaIBSbA:cyUkiY4Kmw1YWN4LasUIq6QjaIAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395526, "uuid": "9c7f4678-f5ce-4bae-987a-d443e5e692df", "value": 11408385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395526, "uuid": "cdf0b682-44b3-418d-be65-12b979ea5371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "410cb514-2ec5-42d1-b3b8-a9b3d8af6e47", "value": "830a22ea4eb2ebb8c60c7731fa5175d3a315d023a812aea40147326cc4c8a4dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edcdf68-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "ff51d496-54c4-409a-8896-6c18222a18dc", "comment": "Malware payload", "value": "b691a8625a13895d84a03e5327e21379", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "417087b0-a0df-4f6a-bcef-3ffd617af0ec", "comment": "Malware payload", "value": "831bff80c68a452ed86560f568cb655740ba0f4c9fcb5f34e86bdc7585a34cf1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "5a1d1d85-5c92-41eb-a213-d3934ebde7e2", "comment": "Malware payload", "value": "ce23552fdc17cd9610a4819913f57e21d0270711", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "91ea1d51-0775-4349-b042-68e01e6d1878", "comment": "Malware payload", "value": "8d0e2be141e08e5f35915b417e167e0380293d1e22cffd46628ca5b4aac21e488e2e614f441371545be298bfadb9cd31", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349502, "uuid": "ac5eadb4-1eff-4fc6-993f-92dbf10da74e", "value": "T12F313E9A00105A715002DE9E76A73658B54EE1EB9D8FC7D4D9484EAE8288BCCF221B8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349502, "uuid": "68886249-be11-407e-bdb2-70e9d3ce9c44", "value": "12:UNt66NtojD0660wbHJpZUsDMd6M0JqH8nqliB6iHrGQfs6AFL6Frb5jQr6jrA4xL:MxokHtUsIxFHx8DHrGibDjon3JHw5s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349502, "uuid": "93bba402-6061-49f8-b601-de8b01432668", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349502, "uuid": "6d2fe380-3dd2-48de-a085-5b85aadd19da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349502, "uuid": "578f0a9b-e4cf-4c9c-874c-0789a70888fb", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec419f4-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "c2d47ed1-b7df-43b9-b762-a818edd357e6", "comment": "Malware payload (Vidar)", "value": "8aadead6badfe60c5ca2cf5d962d3a3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "137b00be-e827-417d-bc91-c1bd84b22a19", "comment": "Malware payload (Vidar)", "value": "8329137dd7ff157263be8ab4a9cce4b08d413724d781b9568759e969e33644e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "6868bd51-b9af-47e9-969e-f908c846d778", "comment": "Malware payload (Vidar)", "value": "986ecea6c0ab4791094d28b6c0108a36e00d1b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "7457801f-b98c-404b-85ba-24368a4130e0", "comment": "Malware payload (Vidar)", "value": "552eba6a6f3c39c96a7269651d2cddf0765223807631aa9b97d10884ae94352ecae16e2a2f3f8cd9b7926fc4a1863388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "4ec0c5f6-fa8e-4980-9790-d9286869522c", "value": "T11D52F886B1D760BED1BD83B8CB8B17BADA21309506095EFF26DE81843A8361175BC724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "3246cc8e-b6d6-4b45-8035-e86b4d27335d", "value": "850ee0121fda1022e1c1de250e3e1e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "2789d9d8-8705-4a97-8922-219bad5c2b65", "value": "384:OOgQyN/Xu/yV6s9MgBb93eF71Iua0lOG:fyNvu1GzbwF71IuaaOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370493, "uuid": "e497aad9-8cf5-4e4b-98dc-0b57462dfb7f", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370493, "uuid": "00229cb7-dab6-49fd-8034-4e38558e080b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "3ff10fa6-1926-4754-81b5-0ef4adcd9ad3", "value": "8329137dd7ff157263be8ab4a9cce4b08d413724d781b9568759e969e33644e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe8d55b-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786372992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "f85c3624-f313-4663-8e3e-77ef8e1f4828", "comment": "Malware payload (MassLogger)", "value": "63f81bf65492c26df9f41819cc39ce2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "fb3551ae-4d42-4491-af42-a3290fc96d01", "comment": "Malware payload (MassLogger)", "value": "833461a1d6926823da8ed605a49a01b762fd30fd9036715f8020b83a937ca99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "620e1c52-5ab8-4484-be65-60215af398be", "comment": "Malware payload (MassLogger)", "value": "295cba9d4650b753541a0132d65e57d0a791c025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "2f534d1b-2b29-479e-afd4-3155690cc4bd", "comment": "Malware payload (MassLogger)", "value": "b74f5c1736ae39d5e5a5514fffe429f3f6166d3247cfb0ca3257b1b40e8387a53c65829e3740dd38bb09a346da1cd258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "85208403-054a-4fad-af7f-9b3304a05cd1", "value": "T1F235F1042267C802D0E68BB6B9B0D37433741ECE79E7C2D69FD96FA774193C29994782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "4d43a9fa-9da5-493b-a62a-dee1a648961f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "419d7a67-34cf-412e-a3c8-08f1f5d37d64", "value": "24576:fp50c8yqrcxqpt+o2kWGKUZ7qb7yGLEENKZQ:fp/ZxKDKmI7yGAEYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372992, "uuid": "539ecac7-9570-480c-9ea9-a4a02400fcb2", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372992, "uuid": "7060a1ce-6d68-438c-811d-9431444fdc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "a847a64c-d96b-4f8c-a5e7-023b87871f5d", "value": "833461a1d6926823da8ed605a49a01b762fd30fd9036715f8020b83a937ca99e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a291b8-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "65a22f2e-21ff-4e10-afa4-cf2ca1f0d5a8", "comment": "Malware payload (PhantomStealer)", "value": "98d0e9c11402f9510835dc44ebe85ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "0888e696-74d0-436c-9359-8602e78b8532", "comment": "Malware payload (PhantomStealer)", "value": "83b642af65de75e7c93a679a8aec05c860f4e505b841fb3e148272a33f58a9ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "8b21d79f-806a-4e6a-92a8-7da9237e670f", "comment": "Malware payload (PhantomStealer)", "value": "b3fc85b9041c47e74a4b8f1ac11e84e349d2f3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "1ebbfe46-f393-4b1d-8472-ec9564b399cc", "comment": "Malware payload (PhantomStealer)", "value": "c95cee1ece4649f152e828b860488aeb85d7767b584247584344f03e96f3243ccccdc38f0777768c2e08b6aa856d3fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "22074589-bd0a-4f46-9ba2-8c4e211d9962", "value": "T17655F00B5E16FA41D0D587B7B9A0D33C22A91DCE7CE2D2834FEDBEA3F5392811954642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "94ac63d7-ee10-4839-a325-5a414df64f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "bad94180-d211-441e-aa80-b576359d5b0f", "value": "24576:+2HElN3dMI6yU1v6QpwMP/5nBKn2bgp50:+vN3dMNyUpl/5BKn2kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373243, "uuid": "b0176fa3-7686-49a4-89e4-787f7d96fbd5", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373243, "uuid": "44c12dab-323d-4706-a6ad-0f087ca99c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "c9d2b874-3bbe-402a-9143-06e1ce40ef17", "value": "83b642af65de75e7c93a679a8aec05c860f4e505b841fb3e148272a33f58a9ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4153c66-94f4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786391494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "b86b8126-c051-4252-90c0-c7bef8b90ba3", "comment": "Malware payload (Mirai)", "value": "fff0a9204f08a82a740b73802d03ab36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "d20974fc-3bce-4e3c-976d-e208f8fc1324", "comment": "Malware payload (Mirai)", "value": "8427c454beac56118f9fcf25eee1307f128af847e2943fa4c5add10952a4127d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "5a7e6ccf-b585-43c8-9312-34505d42c65a", "comment": "Malware payload (Mirai)", "value": "ac1fd954a36bd66072c396cbfba3272f07951cc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "cfde2302-a21e-4cf8-8c3a-31c224af74d7", "comment": "Malware payload (Mirai)", "value": "938ca2245aca280aca5185508824535d10a526f28dd80622cc84c1b26f85ce34c69103d5565f10bd7eb1f43a4f7c0053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391494, "uuid": "c9e3b7e5-24e9-427f-a51c-ad70d87251a1", "value": "T17DE34B02B30D0947D2632EF03B3B27E1D3EFDA9120E4E684651FAE899275D31558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391494, "uuid": "3b5dff1b-e28f-46be-b3e6-eb0e9b6c7fd9", "value": "1536:/AEF1/87shXSxDME52wRb0i5xCZa4FFuMSRwhSg4PHuGaBN8yOQqlvAL+KGgqPYk:4E3moXSxJVQZMP+BeALTM+kvHyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391494, "uuid": "56e4e01d-a17f-4e87-bef8-ecbb214fd2d9", "value": 150204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391494, "uuid": "0fe93cfb-7f58-48b9-bce4-5d0ea7f09994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391494, "uuid": "cd360bdd-0fd7-4211-a25f-c9eb556b8c93", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38db338b-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786355558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "fad0812c-0cbe-4f00-925a-d9086e4451b1", "comment": "Malware payload (RemusStealer)", "value": "2e4aa86a1df193c715970aee3096bf3a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "caefcdcc-9f32-4bda-a98f-5388a713250c", "comment": "Malware payload (RemusStealer)", "value": "843b927de18b16ef40abb48067b6be80e4c63a9e9600342ca672bc75e84e7a48", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "c5b80561-5e6b-495f-8747-c2f85ef9516b", "comment": "Malware payload (RemusStealer)", "value": "4c34f12dbee3457a9c1cf5185f59fc56084de8b8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "61abda40-33c6-43c0-b04c-38e1e66c017c", "comment": "Malware payload (RemusStealer)", "value": "1547294b4d8b04c2d4ecdf9336d540c4daa15950b34f2a92cea9c12715c0a9eeca50c68294ea553cfebcb9b2af7a199d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "4cfce741-947b-4c37-8a39-c449fc2d7781", "value": "T184D63A13AE5649F5C599E735C8B74616BA70B809473133E32EA2BE782F723C16E34B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "89586742-6db7-47ec-afee-882603583d1d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "f28d952b-4e3a-4d1d-ab9c-5ddf7c1ad2a9", "value": "49152:eO6pqtumqgwR9OHynqB1px6BnMp16WD5qACtXFdO75A8W:evqqi0WAO5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355558, "uuid": "a0537441-0b10-4bfc-8b6a-c44bae2ca9af", "value": 13869936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355558, "uuid": "4ea7d86b-39f3-4918-86d6-fe26925c9e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "4386566e-246f-4718-a858-ddea004786b3", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ced4a9-9462-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786328737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "a096e03d-a40c-45c9-827c-5416b3c68ad7", "comment": "Malware payload (Formbook)", "value": "f77fd04907846cd52c41ed987ca960af", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "4f2ece52-19ca-48b9-996b-6854eecc20ae", "comment": "Malware payload (Formbook)", "value": "844aba4ec75e4f229d096f01a2582c66c9bbea1416077cf479fa07d237dc1103", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "92c10180-0986-463a-ac55-258f9e4dfe74", "comment": "Malware payload (Formbook)", "value": "23a1e7f3913f83495744bf7d5aee793800e01164", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "04f07670-8e9d-41d6-91b5-1c1bace400e5", "comment": "Malware payload (Formbook)", "value": "a72ccaf222fade12671730a02d68ad1d9743b2f40cb5e4df6d239154e54b3c1dc7b5fa872d10b4426d9d7a296241cb9b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328737, "uuid": "b902a6fc-99db-47be-8f81-6f2f62fbab4c", "value": "T194E5C7B232DF658A991C3705A44C14A90F6F845A2BC229EDF4CF51951F1F84A7A80EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328737, "uuid": "223eb1af-1401-44c1-a823-08a75388e941", "value": "12288:tZxRDNkbgIgVycoThv/TQS4c7glxSsOJRYkWK4Iq7mczvvl3Hjse5AVoB52bDhxP:RlNXShkZc7JnYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328737, "uuid": "9696f912-5c06-4c96-be1f-3ffc33a3e111", "value": 3130202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328737, "uuid": "f8d1fd6a-06e5-4e07-94f3-534c7c888830", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328737, "uuid": "bb0e092d-70e7-449b-ab9f-2ae8ec56d956", "value": "ORDER_202606001pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d5ae81-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "cf54737c-4bca-4ae3-9be7-ae95feb454d3", "comment": "Malware payload", "value": "b1be8f73aa63acb37e7b215d76230f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "5b1f1926-809a-46ec-8f1b-cc16d64198d5", "comment": "Malware payload", "value": "847cdb3d213124abda19f137c228262f32c4f06e623c253e407f17375bf54d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "f209ebb9-f92d-4838-ba2f-3a11501e0f7d", "comment": "Malware payload", "value": "44e7daefe14399849961880a83fb3ae109da3426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "cca53d86-211e-4419-8a66-a1c3d18b5b8d", "comment": "Malware payload", "value": "e21b2b2807d57d32086c60954f6f4ed6e5bd276515513547ff6a8a53817034abcb5c8dfb2a511618643a9b777463b73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "28be9757-7491-4dd6-ae5a-1bdb8d07742a", "value": "T12815013D5E8BAF52D57C0FBC817604A837F0C11B8126EB2B3FED41F49A527D95826292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "15a7e984-5943-4217-b1b6-43d4346693d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "ce4427ef-b4bc-4398-9c75-1112bfed0dba", "value": "12288:JCn0gh4E1339JCzll10/MLR/3a5py7Nl4NHo2agxIEw2GClNsf:QP13NJC5HPxaXyH6HzLmEw2GClG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369111, "uuid": "1f3e45d0-1cf9-43ad-895e-5374400da1c1", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369111, "uuid": "b85cca55-8358-46fb-8263-1687e8440779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "fb7750c0-0347-4f71-a4d4-f9ca339ef6a8", "value": "847cdb3d213124abda19f137c228262f32c4f06e623c253e407f17375bf54d05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02918e4c-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786346018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "76444a5a-1228-4652-beef-bcbfdfeb5024", "comment": "Malware payload (Formbook)", "value": "2bb5d06f6b0327153abc2b623381a444", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "6a746203-0dd6-4beb-917f-81bab4cef4ce", "comment": "Malware payload (Formbook)", "value": "8484e5f8dc68f1f0cf77fe95bc564b67ddaec743c1fb1d76a167618da248649c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "d9c44db1-d53f-423f-86b9-eefff173a905", "comment": "Malware payload (Formbook)", "value": "dec14fe3607582191986d959405837e27384e226", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "dd0a1795-1b0d-458f-87d6-88fe6572bdcd", "comment": "Malware payload (Formbook)", "value": "2f3fd0f375f4875e3286b3234ec39e1768767e670b8464f51b1377180fe7a12e5e3c68c4b817bf795ab1370a0fa2a630", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346018, "uuid": "70c0e7df-8c49-4ca7-97ee-70df74537a14", "value": "T101E5079227848172B720BBAE6636DE359A1FA01315D2DF01316DEB24361CD5FA34CEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346018, "uuid": "4b7b141e-f358-4ee0-b03f-47ac0edce743", "value": "49152:ZNFntxAao1gnMKHhLkh89VVAnyzFLU0ZbiN4pDdfLgWf9qCxKRcUmXnlsvbNAXWs:ZHntZsSkh89Vcy5LUobiN0dfLVf9qCx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346018, "uuid": "610ecc70-c053-46c8-a656-ae07594d77c4", "value": 3092554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346018, "uuid": "cec5e1f9-af27-44ad-a621-d9f4bf7fcb16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346018, "uuid": "e678c5dd-9760-4ccd-9b50-4c039fa8a446", "value": "HSBC_PAYMENT_CONFIRMATION_RECEIPTpdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69c3733-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "f498bae4-ac2f-4875-b95a-1e471c382ef6", "comment": "Malware payload (Formbook)", "value": "eaed111763b07434094a7081b6b9dadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "b58c51db-2de3-4dc6-8631-6a2d6dc9312a", "comment": "Malware payload (Formbook)", "value": "849db861fac58ffab1622acf5312eaf9c07b87b8ef7a5f0c333e3e8cc07ea9b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "09faf4c4-5a22-4e61-9cf7-90b11f9474c9", "comment": "Malware payload (Formbook)", "value": "14d056ccbbf8be9e7b722abd10d97b1ac805b3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "faf253c5-9ab8-4301-9ef9-e0b668dac7e3", "comment": "Malware payload (Formbook)", "value": "a4a4de4bcff9f9916d85c162fc892ba624365ea7cd4f063d918d197618482a1779d5690eff93f0794478d0c3f84f1e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "99e1c015-12b3-41c4-908e-62e727197b3c", "value": "T12335F1C03729A709CE79AA308535EEB457A92D28B010F9E66EDE7BC775AD3015D0CF42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "0d4a3c6f-ce9b-40f4-b3d9-9b9c3b926c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "17fd724f-d421-41bc-b1a0-335b1803f6a8", "value": "24576:cqGpSOFX0olqdkZJQtFQGXXJA8PuqS7D:ch5tXnQ/QuXJDPVS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368762, "uuid": "e98dc1ea-37cb-4179-807b-e258eddc5bd3", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368762, "uuid": "65fbf1a4-e9ea-4633-9032-92a3f3c460a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "3d027a9d-f75d-4468-864f-f6d5740961b4", "value": "849db861fac58ffab1622acf5312eaf9c07b87b8ef7a5f0c333e3e8cc07ea9b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb3bacd-948f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "21755555-3f25-4130-9577-e556d0685fca", "comment": "Malware payload", "value": "091bb8deafbb346042aa45ed26c488e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "8ef70565-ee70-4dd8-a43e-37857ecee0f1", "comment": "Malware payload", "value": "84acca783aa0926816703ce272543607e332f89bebb2867b9cc8f7218fc5ebf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "0612eb58-a541-423d-bdc8-5869bd4dd294", "comment": "Malware payload", "value": "8bc9ae02c0876312ea002cca556afce01f75df80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "e7afc7a4-e3db-493a-a165-f14af6102569", "comment": "Malware payload", "value": "02fea442b0f0d8bc54869352b23e312a3bd102efa1e55424da24cc3c6eb7acafc26699b25ff1ed465ce76305469bb2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348076, "uuid": "d5e74c6d-43e9-4d31-be17-7109cca9acc4", "value": "T11303F981F247E632C817553567BAC75A3B4379D73EA2C200A825EACCFB674C06DB0927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348076, "uuid": "2d84fef7-ac98-41c2-be66-debfc6cdb7b4", "value": "768:O1sMX5As+KxEDOok3IkWaduaeye8n9UgTTyDPFNzRLIAbdPu4XT3di5tm2b:O16HSfe86NLI4FXrh2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348076, "uuid": "33f0a1c7-6a35-4015-b957-53edb8ecfac5", "value": 40640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348076, "uuid": "4bb279c8-c1f9-485d-ba48-a7e79340bc48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348076, "uuid": "011b49a3-8032-4f2b-88a8-cc2d0604646f", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e34903-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "4ab84a5f-bcbb-455b-9af3-5f9b144d79fc", "comment": "Malware payload", "value": "ac2ce3ef34dacf00f3e1635ee4286dff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "96eb4554-08d8-4a73-945d-7a2d223c94de", "comment": "Malware payload", "value": "850f2bd1d7cfc653944dab58e6f656fb7e6d9781d10a85ce8113fc57552363f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "38ae30ec-49fb-4e9b-a618-4e23bfecd9de", "comment": "Malware payload", "value": "a0f13740c73f29ffc536910108487d05226c88e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "acfa371a-032d-4314-ae2f-72e6b02e2e6e", "comment": "Malware payload", "value": "f18573870ab9671cebc3f61879d2fe609cf9fcf9a53c6b1e3ece2f2d14efa4e47bf3d3a685ac89e17024d5dcf21e7b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "46fd2201-35e7-401c-bb4c-dabfa19828e2", "value": "T18B35F1255D833A44C53D1FB8D167159873F0D407A2AAE79A2FF840F59FA3B86CC2B492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "3f5040fb-adf3-430b-9ee0-a23e306cbad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "72c7968d-e1d6-4c35-a667-614341752106", "value": "24576:ckUOF8HKLZ4e2sAh8cYH+6HzLkEw2GClGJ:f2HKtH2t2cYBHzwEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372384, "uuid": "2eb88b7c-7fa4-4675-a0b6-97a364a89a3f", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372384, "uuid": "0681609e-9f4f-4c6d-8259-56fe3534b2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "54f03757-7fed-4e78-b0df-89242a7c66d3", "value": "850f2bd1d7cfc653944dab58e6f656fb7e6d9781d10a85ce8113fc57552363f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01543b70-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "bd124802-de8d-486f-b1ff-9a8785fcfa95", "comment": "Malware payload (Mirai)", "value": "f591d5fc7ed6e34eb90916e74590669e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "1dd9b01e-4f77-48ca-83bc-d9e3abedfbab", "comment": "Malware payload (Mirai)", "value": "8522dd99e4ea41eb22ebd4e2867d0a993e5c93ae2b3e55aad799808d9e01ca34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "a7d29d57-171d-4967-a910-d98008c6a4a4", "comment": "Malware payload (Mirai)", "value": "6450af91eef9cf2acf16e83016dbff458e4e6878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "923e958b-5cb6-4064-9ea4-edeb3e124a90", "comment": "Malware payload (Mirai)", "value": "4892fc48d6bef63f44f139c93be4efcae189db7fa3e0af7cca7d04e993d9eb99919f9fdcf6710e9a09c976b0d9b1ec4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340003, "uuid": "978c847c-7647-409b-a38a-e24d19b73f2b", "value": "T122E41B1AAF500EFBD82FCD3705A90B1635CC699732A63B353534DE14BA5E90A89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340003, "uuid": "1d35b022-22eb-4fc4-b24c-3516c5fde396", "value": "6144:96MZdIj1HuByPVuvT0S3vTJMCvMFUyDF5Ps2ZljrG987aFN85ywWnr:96UsmT04TeCvMFlP73X7M85yrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340003, "uuid": "c7e88907-b189-41ab-a058-49623b0b1cf2", "value": 681348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340003, "uuid": "1427a5c2-b50a-4370-8544-3f615bd04f5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340003, "uuid": "ceadcdc1-6a12-4a35-8d3f-c706e6631618", "value": "8522dd99e4ea41eb22ebd4e2867d0a993e5c93ae2b3e55aad799808d9e01ca34.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f38dfad-94b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786364293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "73e8f954-e4dd-482f-a06f-804f637c530f", "comment": "Malware payload (AgentTesla)", "value": "c04a92d4145681e8e4ad3111e055e208", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "da8926aa-b477-4ac6-8faa-6b8be43b15d0", "comment": "Malware payload (AgentTesla)", "value": "85269163ce84b80ed9408c3538054b42e6aa035b7c7b1c496cdabb9acf87a7f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "e3b93772-c9db-4eac-8ef0-7e22d5211b82", "comment": "Malware payload (AgentTesla)", "value": "7b2b824fc2bba663bcd69d0d08d9adb9d22ea69f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "8976f07a-f003-4032-a790-98228bb1c915", "comment": "Malware payload (AgentTesla)", "value": "1bf724d91293f7d4a25e765da69af68cfc72355fa7e5f31b1e8d8cd84938dc6b1489e188d3af814e155b960059262fa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364293, "uuid": "2845535c-6dc2-4878-9b5e-b635afe6c2b2", "value": "T135E5D5512785AC327331AB9C523ADDF0A90A615325D6CF1630ACF2187B6CD1BA758BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364293, "uuid": "842a1230-286c-4472-bfe1-aaad9e132f67", "value": "49152:cqfNGfN8AWKHD5YLcN1cAkkpy+dkHowmoSEx0H+laMWC3Pxmnb8IgrGogfwNggIe:/k6AWKHD5YLOpkkQ+WmoSEx0H+lajC3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786364293, "uuid": "afda787a-5384-47ed-885e-d3fb9b8937be", "value": 3023678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786364293, "uuid": "70b0f7cd-fde9-42b8-b275-3ddabf3ba6d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364293, "uuid": "2cc15efa-2cc6-49c0-8ba6-b7492088a36e", "value": "Urgent_Requirement.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab63de6c-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "0c1dd030-b9b5-460e-a0c0-212df29cdf5d", "comment": "Malware payload (Mirai)", "value": "4846a98e33bf324302a57e6269620816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "8aec802e-9fa4-48ca-9be9-34a5b43e6685", "comment": "Malware payload (Mirai)", "value": "853971052934e04c4063d7613fcdbb20c54ab4ee44bcfa184861b021663abf02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "08ae43ba-a8d8-4708-96ef-1f500dd15618", "comment": "Malware payload (Mirai)", "value": "9542054c8b7f61ca8d420d786ed3d2e3d908884c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "eb03b683-ce1c-4187-8c4d-d779fe34b6ae", "comment": "Malware payload (Mirai)", "value": "312ff1c2df431d6b67192dd0e5e7d3f16571de5163f5001da2c63412a68e9c33ea4aa634a2fad361423cad00d6a5c5d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328263, "uuid": "c6d2b57e-4a8d-4e79-8c6f-d9da07919c75", "value": "T16CF2F1AF829798B3C837C77625E75BD04A6E07A6B465FC871101F25BE9470A9F4E42C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328263, "uuid": "f1dcfbc9-da23-4d32-a573-30c94be59450", "value": "768:5wmhVBt5CxVrsvR3l/aReqdzInM3VC3yTSj5af4qJgGlzDpUYso:6QbGVrsj/FuIMFCv5awOVqYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328263, "uuid": "bc83e20f-33d3-4f28-b5d7-9db8b3cc88d4", "value": 34832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328263, "uuid": "398de338-887d-4009-9f08-a3aa43365e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328263, "uuid": "8be7a59e-3cc2-461b-a820-f1741d0f34db", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b610db-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "78fee9de-29e9-4f9b-8d9f-fae9653cb47c", "comment": "Malware payload (Vidar)", "value": "ed778bcdae85fd904ba168840f8f4470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "a96e5b65-b785-4f5f-96d0-c15b4c52f17f", "comment": "Malware payload (Vidar)", "value": "85568ec3745c4f81d8effc6cb3923dd0885e8eca665e63356a90327671cbfa3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "0419dc1c-0b3e-4b0d-bcd2-692232999645", "comment": "Malware payload (Vidar)", "value": "318b473722b79c82e2acf849745db28f55081154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "e9d66e99-301b-4d22-9422-87a7431ae53f", "comment": "Malware payload (Vidar)", "value": "6d8cd1201dd5419530d920e41110d2214b259272fefbb7e4460dd2ee46afa489d9d931f33b84c1d81d91a86c0bb7e4cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "9b97baba-9380-4607-8fc4-6c059afb9389", "value": "T1EE4219C573A5E1BCC46F4238EEAB09775A26340903138AFF7B9984D13ED3341727A669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "09bf6d32-9622-4416-a3b0-4790b112c378", "value": "25141296cd904157b75686c0bdb5f4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "b8d0877b-5c24-402c-ba86-0978b7f400ff", "value": "192:OM3aBCkd9QpoJ/bNj6+VJEGkG6Z+tsth3VPU:O5BCgVRNm+V3kMWhlPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371049, "uuid": "64ed59fa-e3e4-4bd0-9603-1858e0d1e142", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371049, "uuid": "4b8cd77b-b71d-4fd1-a61a-afe3efb96737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "44014ef8-c67f-489d-ad58-691c61c2c38c", "value": "85568ec3745c4f81d8effc6cb3923dd0885e8eca665e63356a90327671cbfa3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5171ca5-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "50dc4c32-d874-4753-9389-55a34372b352", "comment": "Malware payload (Mirai)", "value": "a336c25fb38e0edf9a654008ca0125a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "fef27317-b4ee-4fb3-b3b3-1c5719badfb8", "comment": "Malware payload (Mirai)", "value": "857db7302db0b9c8494e87465249d46e78274f597ce1f6fa40fcb244eb613e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "719fa1f7-01f8-4adf-8ae6-c49943575dd3", "comment": "Malware payload (Mirai)", "value": "dcdd667a84140b8573bb4588246db8bf610c55cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "5e32297e-4d26-400f-b34c-d4ee15737a9f", "comment": "Malware payload (Mirai)", "value": "af24eccea4e9d450f432365205ac5d138e8ad164c1bea5b6d905f28e3186c69850d6d5d473faa4535f73ca90e94c37f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383657, "uuid": "131eda1b-dccb-4828-83c2-b7df431f5599", "value": "T154E34B13A58080FDC49AD1748B9FD13BFB32F89A1335771E2B906EB12D36E616B49781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383657, "uuid": "b8ca1125-21c5-4dbf-ba02-3e8e4851f277", "value": "3072:IvsWFFL3GaWVrAqjFmjPPcIGFpLhKdYBoa/fYHHJEbq1b4P:I0WiasrAYI8LhK2HwJEbqZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383657, "uuid": "33c78100-81de-46fb-a776-9e14d05d576b", "value": 149784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383657, "uuid": "6e288601-63e9-48fe-a442-d7dd77a31a39", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383657, "uuid": "3ac7a82c-dfbe-4749-8ba8-d78ea24376f2", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e689e582-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "25094b81-d7bc-44b5-8602-54b2dc9c317f", "comment": "Malware payload (Formbook)", "value": "99da88e7ae61041b6522da43e13b1cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "b2b747c9-b06f-4224-bc66-a65f08c2bb2f", "comment": "Malware payload (Formbook)", "value": "85912783b7b4046f6b305ebc421130b0015d335624f16f49c471b23ab8ae79d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "e07dd097-ea88-4f51-a220-bf808cfa87d4", "comment": "Malware payload (Formbook)", "value": "8e9de5d0cebafe2235108e642e88e49d9cabee97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "97d93a0d-187d-4ec3-b05a-44ec305e44a4", "comment": "Malware payload (Formbook)", "value": "96460af24d9b3ffc025bfc6a3593a1aade4565958f21880b451a22c2b2e62f5bf3e9f19d4e05084d55a13b367cf58690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "bc174618-0307-4150-ac13-87bdbcb64897", "value": "T11425129D695AEB07C24563380BB0F3B5533C6DE8E011E3269FD9BDEBBA23A544D04583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "e6549f8f-6668-4409-836a-3fff36f8588a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "3b4b0fbb-069f-4d7b-945c-7fbe682db732", "value": "24576:BeQMuH3Z7Zao6rrHcIRz998/AXf5rw70WT/frVMRoT:BvMuZ78rDcIfuof5M7nTr1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371741, "uuid": "607d29d6-06ed-4b5f-9ca0-303ae17e5b8b", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371741, "uuid": "d057c0c9-6365-402a-9a1d-45c0ac6731da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "0fe88ea1-468c-4660-8708-3eb029cbbd25", "value": "85912783b7b4046f6b305ebc421130b0015d335624f16f49c471b23ab8ae79d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f18296-94ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786389007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "84000b2a-4f9b-422a-9ba8-6567c009b8fa", "comment": "Malware payload (NanoCore)", "value": "12d68bdcb0237ab0268b6e3a8f1b894f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "df04775b-6506-4e99-90e8-5cc686e0b10c", "comment": "Malware payload (NanoCore)", "value": "85915561f854b2443c197b6b440425c440f85baad1cabb573a66c2ed39af3e29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "2e170ce3-d4a0-4f13-9270-a5cd277a0356", "comment": "Malware payload (NanoCore)", "value": "12732662a728b6d49c64adf97819ba983a627a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "2abd0bb3-ab90-42cb-8d7d-690582e62262", "comment": "Malware payload (NanoCore)", "value": "ba93784fc1381755b663e73e367476301120f75db6d809f1a60e9e33319ed9c9c1d24c8eca4a04ce927ab30eaf029da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "c9e9dce9-a1b3-488c-92ba-a6f73b2db005", "value": "T1FEA4026A77A8862FD6DE853920124217D7B8C2FBADC3F7DA149854F34B232E14A170D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "0beeba20-c551-4870-ba10-500de4589eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "1871b247-97ce-4db4-81dd-6224097cc856", "value": "12288:8LV6Btpmkj8JBIjyXMa+GtbKALn8V1pbrQrBK8J9R:OApfIJIrSbKwnGFQlvJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389007, "uuid": "01712ad8-970e-42b1-886b-fb47f06f84ee", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389007, "uuid": "ab535105-118e-4dc0-a887-27c60ccb4264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "6c7da110-4955-49ac-9af5-6251f2fee487", "value": "12d68bdcb0237ab0268b6e3a8f1b894f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3650fe1d-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "ba7ac65a-a803-4718-a58c-88ae97e45604", "comment": "Malware payload (AsyncRAT)", "value": "f655e9a77d781ee236ad1d95d12a97e8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "8b7aeae4-3a0e-42aa-8230-b773f8f9e2d9", "comment": "Malware payload (AsyncRAT)", "value": "859d606859f4255cab3cc0ac1de12567fd6f872567f760cfaa09278c56462c56", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "d2bb30d4-dd3e-460b-bdb5-4ffdaaee9523", "comment": "Malware payload (AsyncRAT)", "value": "67fa00a8c59f75c5387555612bef1dd468a0f87b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "32ead5ec-31d5-4894-991d-cc6d216c67be", "comment": "Malware payload (AsyncRAT)", "value": "b30c20d373b2b8e2618366633d3f73cc8541c01db6f2a73213c4cd9d1935478bf7219359f23fb98b189fca7798b95476", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "e1de240f-72ba-4e1f-9b99-4f05363d10f6", "value": "T1DE05E16919178603D4B26FF44D72E1B0577A7CAAA231C61A6FDA2CEBB57B7007C04327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "45d0dae4-d107-4231-91db-bca3117d1783", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "88ac2a6b-2f5e-4de4-aaeb-cadad6ce92b4", "value": "12288:IWSWToqsgOn4qnRj6ft2sTJXzxzX9EfGo96grcq/TPwT466onNFBHYL6:IWSpnjng2idzOfGyV/z+0UFBHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373593, "uuid": "ea2ac979-893a-41fb-8d46-87c3145d4253", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373593, "uuid": "8c2619e0-6dce-4b04-990f-f63979271f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "2b335d65-39c9-49f4-8020-a224d40dba90", "value": "859d606859f4255cab3cc0ac1de12567fd6f872567f760cfaa09278c56462c56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f834ca-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786356835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "c6e5c422-0614-49b4-9c1b-ca045875474e", "comment": "Malware payload", "value": "c81692b67cef88548a874d8377b44c58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "8b076f9c-9963-44c2-bff6-cebd96a8a739", "comment": "Malware payload", "value": "85ee6a5c52f8af675e380b046a01c6b04be998d929618193123f648d50fc3812", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "a5af436e-7626-4b48-829f-75860ada6cc4", "comment": "Malware payload", "value": "e420075b5090b7debe7bfd9fb1b92e2bd10a4469", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "b8f4dedd-799b-4ae7-b90b-eeb605d36635", "comment": "Malware payload", "value": "9ead5f8d4b4c6068e955d80fbf11fd0c620ee4f94913d5cbf9a07f4db798b20ee9d1bd4465945f5f19ec907b7e593e29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356835, "uuid": "dd948552-d8ff-44f0-b291-9d334a1f58be", "value": "T188F08CC8066A30351BD3AA0B1336CC84F7A4D499ED630DBC0C8CE9D2B8A5C60586CEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356835, "uuid": "37323bc6-e543-496b-b456-fd52e13a99dd", "value": "6:lOnFflE0F9FziMxLFziMBviMuiMGcbnMAMQrAdavPcbZus+D5MAMulmAC5Mu8:v0FDzRSTNnrC2XD5N7Q5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356835, "uuid": "ee9684e8-f727-4c97-a4be-3571df106e4f", "value": 473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356835, "uuid": "f79c9c2e-59b7-4828-abbd-ac61c9cd2534", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356835, "uuid": "47727dc1-0784-4296-a767-7072cbeabdff", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0ba780-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786369553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "eeece6d4-f914-4c28-8cbe-e4ff52c9ab23", "comment": "Malware payload (GuLoader)", "value": "690dbabf9a87707e5484b5c1eb501a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "5b5bda6a-b4b2-4cf4-b3c9-cc3ff64c095a", "comment": "Malware payload (GuLoader)", "value": "8648aaee28f16c8e253ff50ebe3c0deeaf6e9a35b5088f252d2594e532f587f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "b5b7a923-9c76-4e44-b2a4-47beeb83072f", "comment": "Malware payload (GuLoader)", "value": "b30dad2efc716300305311aa77c3ed7258e420e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "6f16f6f9-75db-4984-b8d9-415d12b15101", "comment": "Malware payload (GuLoader)", "value": "69b77ed0179d2fa0dd1ab3cdcfa44a13cbe34f4a3748601f08c7921b89ebe62825b7b7c2e00b1332c141098a8cf1e400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "4d49de64-3cb9-42bd-8027-d7570797acb1", "value": "T18A84F1017614E62AD9A68A374C1B97E60B60FE580B505B177254FB7F39F3702DE0E38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "ca417618-46d8-429a-a0f2-dca14284016f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "25ce825e-f63a-4d59-933d-905421bc9ae1", "value": "6144:e6bAcJuMn7pb+YwPk54PCHw6SP19yzFBAkbJWrGjEOPXkEcVenNI:9bNKu4PCHwrbK1VsVcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369553, "uuid": "aba3046c-3485-4b28-91c9-b96a51a5a73c", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369553, "uuid": "85d45627-4fe2-4d93-9277-12e7c7d42659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "7e3b1c8d-7534-4d88-a854-565d6e0b5429", "value": "8648aaee28f16c8e253ff50ebe3c0deeaf6e9a35b5088f252d2594e532f587f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff981a1-9505-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786398520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "00fdef2a-4dc4-4265-88e4-62159011378f", "comment": "Malware payload (CoinMiner)", "value": "4e13b5835a5d12e0b6099b88292ff0ff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "af4cb396-0039-4e56-b7ea-35ed72173731", "comment": "Malware payload (CoinMiner)", "value": "866d659393017609c685b1c0187f13a4afdf43a4b8139275f1487a2187303d41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "87751589-aebf-417c-9b98-a3c42f2e73e3", "comment": "Malware payload (CoinMiner)", "value": "c445bd832786c794b03aa4c2b7cdfc5628801823", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "047652d9-df6d-4c1c-bc36-fc154250d5a2", "comment": "Malware payload (CoinMiner)", "value": "aea5dc868787568bcb9b1dc483db8b13297521b73f886804793d0dba349cb4e0111cff11a2b91e47ba726022618842b9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "ec5cbe4d-12a7-403b-a979-4e92f8b73406", "value": "T1E73633D265CB007AC442C7B4C656B07C717A3B898A723C1777EC7A248E6BB29293D3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "61f8973b-7234-423e-83bc-300d57bd462e", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "ccd8c97f-2ee0-45e0-84dc-d57091330887", "value": "98304:zWTGeP2Vi4Lx7By+A0pMgBnXr308USgeoP0suSwsvsTkuJvchEzRHpaszbO:zWMr7syXQc5ofuSriyqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786398520, "uuid": "5997dbae-abfb-4069-9c11-6afa0c8d9fe4", "value": 5209600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786398520, "uuid": "fdb582d3-4088-4800-b6cd-7dda6f4e0be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "b0fa3197-ea60-45ca-8a97-6d2d4e8d2621", "value": "866d659393017609c685b1c0187f13a4afdf43a4b8139275f1487a2187303d41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1be532-94bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786367456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "f85569e1-8b57-4ac9-8745-b398c2c37138", "comment": "Malware payload (AgentTesla)", "value": "020374cdae3bcca1cefa8f98ca81876e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "3be7b032-48ba-4391-a1b5-74c09ba740fd", "comment": "Malware payload (AgentTesla)", "value": "867e698f133f0dfdb9d99eb6bbe3d9552735ebe379bf5b9f4600a1c863a5d56c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "ed8c6392-04ab-4503-ac2b-19f291436f77", "comment": "Malware payload (AgentTesla)", "value": "b2ca81fa2becb2a4521edcdee8c238b028e54b19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "beb780ab-60f3-41ca-b920-cfc86bce06a7", "comment": "Malware payload (AgentTesla)", "value": "2b1cfa88d2090ab2feb52699d31c94523d6d30ad82f4737831699cbfaa0eba752a5a7e9bafd05e75039e95d882444624", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367456, "uuid": "f3481e40-298a-4eb9-9ce9-d63b59cf2a61", "value": "T1FFE52A8526D9AA737331AFD9823DECF0D50E862324458B1174ACFA183B2DD49B758B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367456, "uuid": "c80797d8-224a-4733-baad-3715381dfdb5", "value": "49152:sCROTp479VGZpMpi0UTLrXhtTI6XZFH1iG1hQe7rM2mxyi+21bcDZqdizopAkhe8:xOTWVapMpi0UT/XhtTXXZFH1iG1hQeny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786367456, "uuid": "1293963d-09ce-4f02-8a86-88e35ea530d3", "value": 3021862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786367456, "uuid": "e3a3e6a0-eee1-4695-8246-80922ffdf503", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367456, "uuid": "acfde4ca-ef0c-4265-a729-93d892131851", "value": "SwiftmessageCopy10082026_pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd0ca46-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786370920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "35233050-2e1d-424b-bf98-ecc112db95d2", "comment": "Malware payload (GuLoader)", "value": "959b979590021ee9c0e1e7ccb610aa4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "d82ba885-8829-4361-8db0-49fa7cad8ae0", "comment": "Malware payload (GuLoader)", "value": "8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "9dc46f91-3860-4730-98c8-579f33776779", "comment": "Malware payload (GuLoader)", "value": "5664db0dda33ad5cd12d7579ae53074b884cd343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "fa2e1bcc-eaa5-403f-89f2-7fcfa8ab3cda", "comment": "Malware payload (GuLoader)", "value": "6328cdf3145d38d49c91e04dfe6467deb403654e8c2e2bde669a6739bf75c9eadd7570623fce5ab961e7bce4ac7c8795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "21db1d14-6602-45e4-80b0-8ea166636bae", "value": "T18F94BE23F654C986D85023F04C7FD86A22676D7458A3560F3DAAF33D6EB3292F11724A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "eb12994d-c012-47b7-9c2d-f5f8b439de46", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "3a6bf8e2-9fe7-4471-8758-d5259b74dd63", "value": "6144:CTA8oPSCIjT6W7scfdwQf4iTuDf2eBN1UglPPG2QYnu+jR1Z+:CTA6TPIGwJieBwgduAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370920, "uuid": "cc703ded-aad6-4e95-bfea-18d7e8fdbf7e", "value": 446032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370920, "uuid": "cd43d024-0375-4439-89cd-b9f3737caaa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "34e4b803-33f6-449b-b91f-14f308c4544b", "value": "8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d05358-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "093473aa-e230-41bf-9b09-f87fc7c78cc9", "comment": "Malware payload (RemcosRAT)", "value": "264bcfa559c722a3f321083cbd500cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "fe55cab4-0b17-47de-8054-bcaa6d8f55d9", "comment": "Malware payload (RemcosRAT)", "value": "86a9d7bbfd120217bd27921cdf336aef9d11ab5c1b2d4a247cbff4f2968e0c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "bf251688-e667-452a-8202-0f264a9a186a", "comment": "Malware payload (RemcosRAT)", "value": "2ceb989dfe1401c7783129e1d19c461310ab12b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "1af41986-4b5c-457b-a478-40f673c3bd15", "comment": "Malware payload (RemcosRAT)", "value": "8ef9fead75667084e90cdcb7d366e3d8984d82ca7cb316c0627aca49f48b8366974e24c7bc48865987f54309aed45980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "3a631da2-ea06-4136-bedb-3bc519b3a7cb", "value": "T1E9452354A7D8D12AC8A2833827B5E23054753E4DF635C334CFDCBC9BBB65B8598A0B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "64e59b06-0148-4d6b-b6aa-d7c4375f5123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "9a29ea4e-fdc3-4572-964a-b8cb3d9306b4", "value": "24576:/nLQ4qNBq4S+Ekfmetc8yZzAEJjk5LwpRjLE4ZbBHFZes20Yfm:/LQ4qbvdJme28mzxJI5LyM6/eFDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368755, "uuid": "496df8b1-a29d-459f-8f3d-e34913d8b26c", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368755, "uuid": "81d58e57-a167-4bdb-bfa9-06417c135382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "ea5658e2-1106-42c7-a2e8-b337b312c89d", "value": "86a9d7bbfd120217bd27921cdf336aef9d11ab5c1b2d4a247cbff4f2968e0c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047bc2eb-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "da42ff6a-2a88-4f45-8a2a-953048f7ece7", "comment": "Malware payload", "value": "c91e9af1219e8b19955fe4f1e5084ac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "6f517822-019b-421f-ac3f-23bcc40d497b", "comment": "Malware payload", "value": "86e9c66af38c4e1016009b17ec9029999c7ca309a635104fc8da33317a86b00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "3048a172-9fa2-4219-8bd2-db0e8d91362a", "comment": "Malware payload", "value": "f93949c0f39f6eefe98b0794047237f5b16f238a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "5dea4925-4e8c-4715-8efb-7e885c930c34", "comment": "Malware payload", "value": "c728c753407babeef45f61dc1959c7c6e9814f3a7636cb06f79cd75850c1bebfccebbe4c4818d4e0bc6e889ccd0d8bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "bad50465-65a9-4e26-8cf3-3030da49aa2f", "value": "T146F7338053568651D1CBDFF9217E1EE3AD3B0DE0B629A0AF06624472F5A98B7C9CC14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "a24e363e-2c36-4289-9857-de2dbac3896d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "534c98b8-538f-41ab-a6aa-930319508bf9", "value": "1572864:PLdk00Hz0uSFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7W7:P2U5aABZVPArg/bXeB7W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373080, "uuid": "8dde7417-f456-47b9-8986-6bfbbbf79743", "value": 73083604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373080, "uuid": "8d13e173-4817-47ce-a594-e611943746a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "fa98ef41-0c31-40f8-bb4a-1f862a48ec40", "value": "86e9c66af38c4e1016009b17ec9029999c7ca309a635104fc8da33317a86b00e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473f4877-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Tofsee)", "timestamp": 1786369327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "0aa3179f-1156-440d-a8c2-250fb473cbe4", "comment": "Malware payload (Tofsee)", "value": "74c69359bcb6bb285e786ff2a2c50d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "7b51af0d-d90b-4958-a801-b613b22b6ce8", "comment": "Malware payload (Tofsee)", "value": "87537d77b9cb04af349eb1f9aeca278501482b54722d2d3801f90253b58f1bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "b1dee875-f874-4a7d-b125-b0a621d1586e", "comment": "Malware payload (Tofsee)", "value": "cc63bf3f3a360aa84adfa710b5396c99523a8188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "34325a03-0f69-479e-af3a-758eb6d41743", "comment": "Malware payload (Tofsee)", "value": "4d6b3e5da877304cb37af06157a83fb8f42ef07db43dba34d7ef53f8741968a74b76670e5ef71de02de911ddcc793f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "6cff04fe-6a15-4066-84e3-7ae92ad8dac1", "value": "T1E8C6E02369452039E2AD17357A76DFE0A73B6E90681E8D0FA6F0347DCB351E029366C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "048746c4-67d3-4c43-b077-f4d0c2ae9e27", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "257f1d72-36c7-42c8-b119-caebac12abce", "value": "98304:qoJJqUfbatOwMlvace/2BtBjK65FxIGf9Ax:p15wMFe/SrfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369327, "uuid": "7382db6b-bae3-468c-8a1e-f9435ea020d4", "value": 12380887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369327, "uuid": "b3e6319b-ffe2-4eae-a766-61d636ecfdd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "2c412969-8131-4658-907d-b05989f49d1e", "value": "87537d77b9cb04af349eb1f9aeca278501482b54722d2d3801f90253b58f1bbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8670bc-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "6ea5e33d-a3a7-4f29-be98-9a8213372e78", "comment": "Malware payload (Formbook)", "value": "ff51b0cbc5929b65e0ff470b3c25cdb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "3cfb8b77-e99e-4685-a2ef-83bf25d2dd53", "comment": "Malware payload (Formbook)", "value": "87691458306e42eec95b219e128eeeb3a7dbaac2ad595d173823840542df9ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "5bb8d221-f9f1-45e4-a5d7-404b670555f6", "comment": "Malware payload (Formbook)", "value": "a88d641ab198405d17c27ff4de5adcdbe843c9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "78653a72-e013-4f19-a745-389bb11347d8", "comment": "Malware payload (Formbook)", "value": "c0bf1a58673ae69c2c56986411fd7278ea78cd86b21617adf3d75a956c3e901f0ac439d024e3591ec1969669dd19c410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "4199949b-97c1-4783-a167-495475fec39f", "value": "T1D135F1242217D802D1D6C7B3F8A1D7B422A54ECFB9D2D2875FE93FE7796A3C21990241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "24d27d7f-d7bb-422e-bd3b-be26994bd97e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "04ac7e90-4425-4274-9e65-74d002e4b738", "value": "24576:ep50xc1fqOLKhjVQq7koAKAntNtSRscOmy5cjoA2ywwgg6LDl4:epN1fbKhjB7k6ytQpy5cjfrwwel4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372615, "uuid": "b77b0bf9-675f-48b3-86e1-1ae025ac0653", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372615, "uuid": "15cc6598-0393-4aba-875d-b4565d66e894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "98e360ef-f7e3-4ae4-b5c0-0e1fa988181e", "value": "87691458306e42eec95b219e128eeeb3a7dbaac2ad595d173823840542df9ccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ec3e37-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "3d222fb1-a579-4c6d-9007-ed2c4bb9a128", "comment": "Malware payload (AgentTesla)", "value": "602ce630a197ec799e26673ba393ce40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "05fca600-d63e-4663-b48e-e4cc3f8be17e", "comment": "Malware payload (AgentTesla)", "value": "87a2f6b337cdbc7660306c29fbde194f7b7c9c3ceb3c9b600f8cffe4f7032279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "ef4a557c-9047-4baa-9e98-b50150b6d745", "comment": "Malware payload (AgentTesla)", "value": "b2d48c86c49f0e218a5f5508333aa312988829d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "cee0a7c5-0d09-4428-a314-c07fb82847f6", "comment": "Malware payload (AgentTesla)", "value": "027668d3229471be17a545baabf201cc480e478035ccb2cc365d5d2b0b0e0317728958b7ce8e6d7c76ab8586ff2257d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "6410b49e-13d4-4e2c-952c-7e416a26555c", "value": "T1CD2513596907ED03C50407364971F3B522BC8FEDA942D267ABCC6DAFB922B89DC90193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "cd3422a3-1cac-4e66-9998-311ce4e9ddbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "8a0fe9ca-e2c5-47a2-8e21-9e967fd04237", "value": "24576:5U5LAeomAYk/+i91K65z8uA8Hk8QZeJBbHO:a5Axn/+s466uBkIbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371826, "uuid": "b905a83b-c568-4679-bf84-d382f287e1df", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371826, "uuid": "c77f09bf-7638-4aa7-9d10-4c2a10d28413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "90ea1d62-6ab6-4827-bb99-e3ec0cd08d5d", "value": "87a2f6b337cdbc7660306c29fbde194f7b7c9c3ceb3c9b600f8cffe4f7032279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8f78a0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "8ed2b3a1-655f-4caa-9bef-a3646ee04a0f", "comment": "Malware payload (Formbook)", "value": "7dc933a2821e9c329cd6abb9de82f7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "3ad26908-85fd-4715-a718-ec068c14b8e9", "comment": "Malware payload (Formbook)", "value": "87b6afb53d95c2d6cab996658c903eecd4c1f7c4f5dab5dad4949aaccce9fd67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "16ca0507-9da1-4261-a6dc-dcee43e4e5ea", "comment": "Malware payload (Formbook)", "value": "70538b8de5fe03412e9c74969eceb210f74e549f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "a8aa6037-bd63-49c8-a6bd-67b127a77301", "comment": "Malware payload (Formbook)", "value": "332d08b08749d0ae09c37fd273ef39af6d9056e6353e2a9b0300df89caf820ca01fdab2a428add4b4046b3ed5efc6fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "b1184b92-17bc-4ef8-afcf-1776dce20794", "value": "T1C2251298134BE507CA421B395DB0F27852A84FDAB113C62B7BDC7EDBBD35B5A0D84182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "f3b8f6bd-1ef2-47cd-ad33-a71875871825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "0e53ab2f-1d0e-4c9d-b623-42e12baf64fa", "value": "12288:C3VlJdbfPSLtVRmKu2TGxpshjV76Kqt+wz3wCe6rRsI2ViMKHV71Xj03PyzXbB+P:Cll4tu32KShjg+wm6SI4iMS1z0EsrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371916, "uuid": "e8e06ca2-e206-47a1-83d6-e0e9443140c7", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371916, "uuid": "2ecd9748-e433-4970-a3d2-41bf53e4d24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "658fbdc5-66ff-4a16-9e64-88bd2efaafde", "value": "87b6afb53d95c2d6cab996658c903eecd4c1f7c4f5dab5dad4949aaccce9fd67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1164ddaf-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "a0f4b2b2-61c9-48c8-bd64-ba2a74c7a91f", "comment": "Malware payload (Formbook)", "value": "f715494192d8893b623e732a602ae938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "26f5e833-f82d-4b73-81b7-c490d2d4591f", "comment": "Malware payload (Formbook)", "value": "87bd19813c653c980443a5b51bd0569d1e9e206e4e116c2d59b1e6398b99d9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "bd483c06-9089-4d96-a388-9f2ea0bf06dd", "comment": "Malware payload (Formbook)", "value": "b405532419e938f0b787fbef2830f3ba9a2a5899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "a451282e-4ce6-4cea-8467-4828745de39f", "comment": "Malware payload (Formbook)", "value": "eb15eacf228b1b3f81c3e61ba8bbd6828197e30320f1f1d0d61d60a4be2c85e8d1f5ffd19db5d3677831fa0f8e5d072a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "8467a33b-4419-4ac3-b205-93d14bc4c142", "value": "T1112512406685C922E0F647708EB3E3B287713E5ED118D22F4EEC7DEB70B0B865650A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "d696825f-fd63-4231-9165-24fbdb55b82e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "3213d26e-ddd0-4c3c-b77f-2e55d23f9899", "value": "24576:fQ45lLi9qPHNfXOZh9EFpNVK7Ru6FFyX3NutTbkc:fQ45lsqP+qFDVCuiEX3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368807, "uuid": "e5fd0fa7-39ef-4265-be8c-50bc9d72713d", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368807, "uuid": "d826615f-1b4d-49c9-8f37-7d6804660d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "2d1ab512-61c5-4985-82c6-8bb5214430d3", "value": "87bd19813c653c980443a5b51bd0569d1e9e206e4e116c2d59b1e6398b99d9fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1ab2aa-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "4ae81f5e-64d5-47d9-bec8-52acdb63a398", "comment": "Malware payload (DarkCloud)", "value": "935cdf813e9fed1079507ecfba8b5544", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "18563b76-1909-4322-84bf-208dd64c55ac", "comment": "Malware payload (DarkCloud)", "value": "87bfea1c2005742e5d6f6f11fdcc33585d74784f45db91b518f77df3e54e6621", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "c2736205-4f9c-4043-b632-b003bcc358b6", "comment": "Malware payload (DarkCloud)", "value": "a0515c54a58050366c49d9c2e85fc0ae437b3c31", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "b2da6cc5-dca2-4d21-a94f-046adf219893", "comment": "Malware payload (DarkCloud)", "value": "d91f8a6efa6cfde7f9ce8f91c2160ebfd09c8e367300473baf145c8497a82e5bdba08558cbdf37cb3254efc655bf9291", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "a2eea28d-1715-42b8-a5ec-1afd073a872d", "value": "T18855E084EA844660DC6A9BB12A37CD3147333DEDA830E51D29CE3DAB3BFB7961025553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "b5cb25cd-3334-492c-83bf-4c839b138031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "3b4d57b5-3aed-4c70-96e0-d745b49ac1bb", "value": "24576:MYFqRzQ6Kk5ZMj5BnVPO/g4HUVHx0OphTDV3WQVe1q:/f67W9RJO/Kx3B33Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373977, "uuid": "64a7962a-7e07-4a65-bf7d-7c93791696e4", "value": 1398272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373977, "uuid": "6259d9d9-67dc-42f3-9506-5855bb70393e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "f350ba30-f0a1-4ae1-bc1e-b849ccc9e809", "value": "87bfea1c2005742e5d6f6f11fdcc33585d74784f45db91b518f77df3e54e6621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992551c1-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786348419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "a834f055-71b7-41de-8290-617c85a02ea0", "comment": "Malware payload (Mirai)", "value": "1b2c0e113af7c9aead2460dc08d1ee85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "ca92094f-26b1-4e4f-ad7c-aa9a9aaf265c", "comment": "Malware payload (Mirai)", "value": "881d5a6b504c1b56324114757c4cf27cfd41c43ed49804eca0f1c5500bafedce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "0abeb90d-b700-4bc8-8410-df1c43c98402", "comment": "Malware payload (Mirai)", "value": "99bb5bb2595038d6414c5dea3e6f283b92763b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "8d3f615b-fb75-4491-882b-e26fc77c73bf", "comment": "Malware payload (Mirai)", "value": "b0d02a7c7fd878385a17ed6b919984955c2d5c9cf04ac35137681d16494bfa7f12cc1b9f722d1cf2b5654c130a90698c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348419, "uuid": "9eda3251-c551-49dd-ac71-aaa8a07c8130", "value": "T143B42965FC809B91DAD12ABFFF5E824973131B78F2DE72129D051B2163CB84A0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348419, "uuid": "7107e10b-6b38-4aeb-91e7-bb3d9271e758", "value": "12288:TjnlAxBK/BGeadYWp3LX4nsXunT9oxfN7Zg1uvjaOA/dFESb1vT3x:flyhmoVvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348419, "uuid": "7f444cb5-8021-447c-8460-a3b470767520", "value": 497344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348419, "uuid": "bccffa82-522d-4947-b23d-67cbf9f88ec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348419, "uuid": "4b6db1ab-d731-44f0-a00e-e3cebe954e76", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cc7ee3-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "f1d7835b-4ec3-4c06-a71d-c2364429cd83", "comment": "Malware payload (Mirai)", "value": "a678fa133093e9e804f9077ddc704524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "b2d62b69-d80f-4510-abec-e5d440da8b6e", "comment": "Malware payload (Mirai)", "value": "88c2184f05094c2e3adea9fc8861e87e80b4e51c14d6e093e8447250c950949b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "1467ea00-4e8e-4f96-b570-7cd7989dbabf", "comment": "Malware payload (Mirai)", "value": "5e26309f460859c82029a02890cb1d8d28a76a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "e7618214-3eb8-4632-8b3d-d56ab3aeed23", "comment": "Malware payload (Mirai)", "value": "faa8fe7d7c6549bd1e349a3b1e9fbac8c81c22a03d858d9d1942ce96a3f9555db8a4019d8e10282df2d3eccab66849d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383677, "uuid": "e8c4a393-be6b-416a-9e81-929e7a9fb3ad", "value": "T13D343A8ADE650FEFC5AFCE34065E432715ED999B93F0A336457CDC48768E20846E3468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383677, "uuid": "77eb8169-4e2d-4637-8282-fd3a197affaf", "value": "6144:DTOxo6movXlQYx1x2iq21qqBj8Lsz08PdvrQlm+YsMv6myjDj:DTM/lQY4C8N8PdiYT6jDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383677, "uuid": "fca82eeb-8641-4e45-968d-fea50c7613d1", "value": 249564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383677, "uuid": "6fd32c97-db23-444a-b2c8-43f65ccdaf91", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383677, "uuid": "e95b1aa6-e03f-4995-9e4d-67abc8412e91", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47bd7ab-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "e6789eec-43a8-4ac6-b398-6832f6aedd98", "comment": "Malware payload (Formbook)", "value": "a50e74d44e5206f6b7e554013fb2cae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "c7bf818e-26a3-4f38-83d8-29ab40a8263b", "comment": "Malware payload (Formbook)", "value": "890499482db9f8777c7fb183fa4d72db6d1b6f4fe0326ae851a5e659d6d99a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "75a54810-6979-494a-a624-c5671b0a9394", "comment": "Malware payload (Formbook)", "value": "351510977c0da401f59f616070919c37f8167d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "a91ddef0-4083-40f4-acee-2c4e23dbf239", "comment": "Malware payload (Formbook)", "value": "4a89e09e77a58d649e59bb638ddf59565bc5b11937ee79b580fd7f243bd5be03a5bd6aee5f534d87255a8f1f5e6e116e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "b898e7a3-2501-4b04-9d31-90c9fc26e902", "value": "T1BB3512942F4EC801C4A25735CEA1E3F912B62D9EE532C6038EEDBDE739762075C25B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "25dd2312-75b1-4827-ad23-e3b45930134e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "f36262a7-978d-437a-bbac-ee7387508cd1", "value": "24576:cKlCvg+Phf4oqOpp4/MWrkeZ8sF4cvBmAsf0PvTg2gdmNvTdMr:cKlCvg+Phf4rOpp4/MzcNF4cvTPs2gdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370342, "uuid": "135eea9d-5a61-4873-be51-bf64a5ddbd9e", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370342, "uuid": "7f854179-7e01-436a-98a8-354bf07e4bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "9b82a742-8b6b-4a43-9189-b56fc876dc48", "value": "890499482db9f8777c7fb183fa4d72db6d1b6f4fe0326ae851a5e659d6d99a23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce0bff7-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "8dfab6f1-de33-4396-83ca-361e67ba4fb4", "comment": "Malware payload", "value": "5e1e2487558059f8b1595e341c2eceb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "ba1781a3-0644-4417-b3c4-9311991c7c24", "comment": "Malware payload", "value": "895bc3129be3d472b73f493895b2fd6f974f9706e266539751ec0f97b5e741d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "d07399d2-06ad-4e30-a359-1d61a832778d", "comment": "Malware payload", "value": "26d6031b7ecfb276e943d086e8d846629dccb6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "cd521e16-7d8c-4a6a-a7c2-a032d98c8bd9", "comment": "Malware payload", "value": "6ccbdf63a84ef3a127706594c1cc3010ee308ecc914e41183f2e896af58a1b9701b449c66f7610f2e6a73331925d62ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "4c577691-f6dd-4b1b-abfe-577cbd9a5947", "value": "T10E833825F1D901E6CEBF72B874368BA6DB3893E551144209CA8CB9B93DFD31044B0A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "e9c519d1-bb13-4e74-89a0-9bf4d56ef0c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "926e78dc-6349-46dc-95e5-59bf1651c0a9", "value": "1536:7bm1Qs1WyY/URBNwC9+S7XVTy1PJe5a1DIKxJVzpArePK6CtTvJsANVR5:7bm1QswL/UrNbUSrcyjR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372155, "uuid": "9e4e5446-eb2e-49c1-97a2-4d2ee45416d0", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372155, "uuid": "1d976bed-9260-4ac0-8121-3124bcd504ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "16bf2252-f4d9-43ce-b50a-8dc7e60e1ce6", "value": "895bc3129be3d472b73f493895b2fd6f974f9706e266539751ec0f97b5e741d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d05a7d-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "638427db-4702-4ada-8dfa-5e61f9e51658", "comment": "Malware payload (Formbook)", "value": "c8304651b0f64e249462e2d40e579f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "7be4937b-b391-4170-914c-7d4f72263fa0", "comment": "Malware payload (Formbook)", "value": "898b7431c629070487a6c67d88995fbbb9076869d2de5b6845244f86c598a28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "841d231f-4450-4ad3-82b2-0c6c363476b2", "comment": "Malware payload (Formbook)", "value": "896f315b215d5f480edb9916f9b392bae489df57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "3775b5ca-60ba-457e-8e9e-86292f72af17", "comment": "Malware payload (Formbook)", "value": "62ffe0ce2203c9c9c8cb1afc04f97a58af03653233a14489071618d421d12a7d2388624bd3538238949ea6c8318800b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "692e4265-6147-4d7f-8c24-cc2a4ff4b429", "value": "T13C35F1045717E802D0D187B7E8B0D7B432A84EDEF9D2C2976FEA3F67792A3D11594282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "853c6668-d945-407b-9288-1baa0572a3da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "f03c4b47-890b-4c64-9c7d-1adc3215602d", "value": "24576:C8hvp503ZSLMkfsviLkxNyI7PyYsmbvC4sNry+g1FfUlI3f:lp8SLMkfsaLkiI7PRs1bty1FfUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372594, "uuid": "7738ec75-6df1-498e-a35c-c971f724149d", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372594, "uuid": "d3e0ed9b-75b4-4f05-8d11-c8bd8d63b7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "92f4fed9-9e66-4bf9-883e-386d289ced8b", "value": "898b7431c629070487a6c67d88995fbbb9076869d2de5b6845244f86c598a28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8baa1af-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "25a30a1d-0fd5-4b80-a90d-ab32d8a80eb4", "comment": "Malware payload (Mirai)", "value": "b42a37e6c1cbafdc5d4287b0cc63de37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "598ee8f4-daad-438f-9425-471862e2f05e", "comment": "Malware payload (Mirai)", "value": "89b4a1ecfb1f6ac02f9bae48ca1086752646004da5039fb5cea166325a92dd86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "0f1d8610-2664-4b2a-96ae-c07affb2da94", "comment": "Malware payload (Mirai)", "value": "3531d0c6815720c799c71674555e043979821b69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "0a5abd4b-464f-4980-967c-4e1b91a9b21b", "comment": "Malware payload (Mirai)", "value": "f185de19695bcc6924ca4a1f03b45ed5323cfb083bf00bfdb7340ba3d53bc48549d67f7840809e7df4d67a092a2e205f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347183, "uuid": "0b4693f4-5f46-49ca-82d9-f64476a85a3a", "value": "T1CAA3A71E2F619FBCF7A9833487B74F34A65823D122D2C584D1ACD5042E3435EA91FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347183, "uuid": "e4bf6964-800f-403f-b980-0617308dbd90", "value": "1536:9N/rBcOxCSW0QWSgpUHmJ71YRIDR3e/1Ftf3QZEpx/L1PAbSPIaV64Db:7BgH0QSJxYQR3yFtfMwx/h5Ijmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347183, "uuid": "8542389e-d50a-4626-b07b-535a36210a03", "value": 103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347183, "uuid": "8db5c365-7f58-4e9d-885a-e816eb28bc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347183, "uuid": "cb4f6e97-5282-425d-8526-a1377b372d27", "value": "2EUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9672f293-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "c59872bb-b8de-4339-a366-75e04db9a9b1", "comment": "Malware payload", "value": "d82dfdb1aa44ae7e2fb90bcb9d492a45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "9763951c-8b61-47c2-a8f2-0b1afe781a48", "comment": "Malware payload", "value": "89b5e19f4d9c535a5259033d35f8b69c7fb66a147e57af41d0abff643019447f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "a44e4aee-c93c-4100-8e29-0ec54f955caa", "comment": "Malware payload", "value": "c8f68771a25675036e51c418c7c94b5a0ff79ecb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "408ea289-8b39-4ec2-9dc8-483eac1a904d", "comment": "Malware payload", "value": "60a3f1c17bc0176030c3a188a721d52a19ccec7812ce70f62e6b9ed89589802793235acedd5d101541fb4fd5f3e3e25d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397377, "uuid": "01bd0693-9f63-44e5-8bb7-d7232d31f8a8", "value": "T1B2235C6516867C24AE98C4361C7E2F0CB9AD83E6324452EE7FCF3CF68C4A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397377, "uuid": "7ea49a6e-7209-4c91-865c-5fb63abe8d7a", "value": "768:A+N9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:A+Ocr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397377, "uuid": "4ceb41cd-0a0e-40e1-8c28-c1e19df20ea4", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397377, "uuid": "5eaf510e-9e91-4c95-aa50-bd14d0551ce4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397377, "uuid": "9b6f15d2-9bf9-49d4-badd-c36d714051ec", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90019db4-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786372026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "60ef7bf7-9312-4859-829c-c30ff23d220e", "comment": "Malware payload (DarkTortilla)", "value": "3af10088b300f65db5db0389919c9138", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "c3e9f4fe-83a3-498a-9018-f8c54048dae4", "comment": "Malware payload (DarkTortilla)", "value": "89c3dc480c498b02017a7facd801102364434fd2fc2e9669ff8283b8e648ce39", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "5cbaaeb3-237e-4aa8-9037-243c5b0939d5", "comment": "Malware payload (DarkTortilla)", "value": "1b053ea979587461c63aef16e41b506206bfa46d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "7347b606-f459-4018-bdf1-27ac8b21a323", "comment": "Malware payload (DarkTortilla)", "value": "78616eb305743987f925cd1ef5429249adf111d47b4af5d05f3b7bb2455fc07a0efb6cc9d4c303feaa29ce3ae08c58da", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "9e8299aa-cd99-4228-9c21-40ff08887a9d", "value": "T12345022DCDC32B44C67E1A78C15648AC33F09F17E2E5EA5B2FE900F58B92568DD264D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "c3b2c790-bd91-4500-8669-29156e48882f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "4fc85d29-0f66-4c98-9002-b8f87537c52f", "value": "24576:KSckHlVzaqMH/qCzcMLqpJ/EHbMWus6HzL7Ew2GClGZ:fFVm71s//WuzHzHEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372026, "uuid": "8b83ebb0-31d8-455d-a9f6-e7c4b349ff07", "value": 1205760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372026, "uuid": "7fe15a5d-b526-4838-afd1-224bfc26de58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "2552df60-4e6c-4e25-8b75-ab46b9dbbba9", "value": "89c3dc480c498b02017a7facd801102364434fd2fc2e9669ff8283b8e648ce39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63fc080-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "fc3c7e9d-c0a4-474b-8647-f6b1bcaf6819", "comment": "Malware payload (njrat)", "value": "72810ea66266438a5658b6883b31aead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "190b2c0f-454b-408b-af27-fd9876eb9361", "comment": "Malware payload (njrat)", "value": "89dde821c9a2435b5c800ba381a1b80f949642760e23583c35c2132c071457d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "d8c606a9-d457-4ea9-a224-0aa00fd0c799", "comment": "Malware payload (njrat)", "value": "02f40a8e4ff6c4f700d77d224bd38403fe1b9f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "b4f3dc09-a049-4a86-9d93-6de27e9f629b", "comment": "Malware payload (njrat)", "value": "3d844833860d9f62720e95d8ee1734c4a52d11885e8f968df861e2e1b2643c46e7fc218e8309045f261197390034ad7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "0f4ad56e-0ace-4901-b452-4d1ec43e8822", "value": "T181150188231AEC02D5A25FF11E70E3B451B91E84EC15E313DEFABDABB46E2853D452D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "faccdfa6-d544-42fd-87e9-fc18bf5fc3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "e9b0446c-eaaa-49fd-ace7-002b8a4901b0", "value": "12288:BNe0/fJ6L9FOdMpC4PthQmKGFCJ65Whqg5KYZBF0xsCOhesmmwnaKMKWj:BtR6pFg4lfKLJmW4kKYR0BOcsKMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370855, "uuid": "5f381fd3-573b-49f3-a465-cec110424271", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370855, "uuid": "6ac8b73e-64f0-4a8f-82b2-7c5a0be3b94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "08fcaaaa-093f-4675-a828-326a0b2e9657", "value": "89dde821c9a2435b5c800ba381a1b80f949642760e23583c35c2132c071457d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627ca0e4-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "9d37a3d0-42ea-4cf7-9642-928932320e3a", "comment": "Malware payload (Prometei)", "value": "cc23dcfdbba5bb8f7987ae709e3559a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "eae92484-20f0-4400-a2e0-8e536e1ac15f", "comment": "Malware payload (Prometei)", "value": "8a0aa04876b1221d0330ddfb7a4153c80e9eec24dab9c1fc2801fa5a14076ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "fb24e327-e912-4f28-97e4-7ecab3a59aee", "comment": "Malware payload (Prometei)", "value": "6ece81ae575977eb112f31e3877b5225dcbd102f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "7cb9ba51-07fe-4411-801e-cc8153f80f47", "comment": "Malware payload (Prometei)", "value": "1c69cc87f0e116128f800cff548868c75caa372aa6c1c106435fdc02481dc74ccbea13d0005a3084d1ec933154cfb169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "e0d88ef6-c9c3-42de-bff6-f1a840c726a0", "value": "T1BA34F13668B83F14D423B679720B1F3281F5571F3A3B156CFAFE4BB2B1646110A6358A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "ae6d6384-e038-4445-91ae-999b08ff3dfc", "value": "f418afe0379776397753ae40798cc2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "216df8f2-2de5-4f9a-96fc-0abef27d3673", "value": "3072:FjYKz0b1fne3uapce5iUOIHJRsoIWl2oPlO72vGvW246N6aPGjgpdSVife12u7XR:Cre3NpGUOcnsoP9AjUOxvSVey7Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327711, "uuid": "a40bb0ee-7431-4cbf-b19d-9c02b33b408f", "value": 248416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327711, "uuid": "99fccc88-8454-4de6-b6dd-4d5ba957197b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "81692177-442a-46e2-bea5-c13d65bf9694", "value": "8a0aa04876b1221d0330ddfb7a4153c80e9eec24dab9c1fc2801fa5a14076ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8f9aba-94c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786369949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "6fa35f95-c68e-4f39-bb99-53a5a588db87", "comment": "Malware payload (Efimer)", "value": "ec77c59faaed22b4fc25a4dce40e681e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "caff96f2-7fb5-427b-8faf-0434fbacf35a", "comment": "Malware payload (Efimer)", "value": "8a0bc5750ac5616bd3a688d540d68f8f231774e0718cd5401601fce7d8cde93f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "cf793e85-a1b2-49f6-9293-ff99cede5ee9", "comment": "Malware payload (Efimer)", "value": "15ce9dc5036f332b33094761d27c94877e23e6c9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "ed4476cb-24b2-4167-af6b-8b3ccf4bcbe0", "comment": "Malware payload (Efimer)", "value": "0a1c3e942194c08d8e7e9602ac8156d6f7896134238d7407439cfed1359f5b155e4b67f359f22f0e0e0ad967f84dec4b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "315d5081-7480-4cc0-921e-93d4d6a40309", "value": "T1A9E6334CAAF012BAF9F35078BED21155F531F0661B72C9DB9B989121AE233E04E39717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "04951d87-3d22-4b80-8c2e-2692e797c90f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "0685e54f-aab1-45c1-85c7-dbda7d50bc5f", "value": "393216:aVdEdo9Pe/aAq3qQXRWb3XMCHWUjcDcuI3/PGTAI:aVdbPe/azaQgrXMb8cgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369949, "uuid": "df048598-cbc8-4b82-a965-9a32c09518a6", "value": 14080399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369949, "uuid": "52f0cde7-6cb0-4ca6-a965-12fab52723c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "7b751e74-4221-476e-b592-9aaaa0f23ad0", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa70df20-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "d3038e9c-fc6d-4999-8b6c-be4cad72be61", "comment": "Malware payload (Vidar)", "value": "a18939b7fefd9da799bffea07ab63f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "42071cc8-e453-4d5a-aab1-80e218157736", "comment": "Malware payload (Vidar)", "value": "8a9f82d0e899775ad048140a0f385309a9f560cd8a909cc2e4b71b76709cb52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "b70063a8-0cb1-4a61-a1b1-c5fad5fb659f", "comment": "Malware payload (Vidar)", "value": "da38b96ddb9f3915dd53c62410aa854f3ea4cdd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "74b955b7-18a6-4a4a-ae95-98679ab1f90e", "comment": "Malware payload (Vidar)", "value": "ced77131f563eecb6e058b9c71801e4b7f25f8000c97f08ef8da808c5c5fb14adc3263da6930b813781845ebb5b2be85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "79d3dc2d-5e47-49fe-864e-601a783755e6", "value": "T17562D69F7197B0B9D1F4833D8B8E12B3D663708A071A5FBF95DC86442AC176026FC252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "25d67f3d-9fbc-44a2-b838-a945b5b7e34c", "value": "e489cd9c73beee1db4c320380f37924e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "1274acba-4ef2-4b5b-8f1c-dbe92d101654", "value": "384:OkXm9zFUcz8RQqUHvvHS6qb3HUo8qyNTLGygHli:B+8RQjHvqZP8NNTLCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369493, "uuid": "c92730a3-a564-41e3-934f-59469bb6747c", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369493, "uuid": "03decc20-919b-4ae2-bedc-c0675bc039aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "523dac99-c9a9-4581-a1bc-7602e7318201", "value": "8a9f82d0e899775ad048140a0f385309a9f560cd8a909cc2e4b71b76709cb52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d135dbb-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "22202471-fb07-4bb2-bdcb-a5b8d7ff132e", "comment": "Malware payload (Mirai)", "value": "593625970b6e5161c1bc6a8193413012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "a307c796-c21b-4575-940f-b1a1387a92a6", "comment": "Malware payload (Mirai)", "value": "8b0e129a647a6ccea436f6d16d3043337a723fe48bf19f366e22e7e5149500a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "50c0a863-6352-416a-99b4-5959e88d71ff", "comment": "Malware payload (Mirai)", "value": "084df6a1125e9ac4c44af8f9450c003ff66f0b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "e43a77e8-8087-4523-9962-7a7ee8182d84", "comment": "Malware payload (Mirai)", "value": "774e7e372a498f499d0a6c9dee7911e97d4739f32ae182047fce9e49bd4f4f2e0b3624cdc9cee760e4331f35dfdb04f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404636, "uuid": "b78277f8-8539-4f9a-886e-2872ee80234c", "value": "T1E823E556F4D0DE62C6D43179FA5E119C33674BB8D2DA3202CA207A3537EB56A4F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404636, "uuid": "69939661-32c6-48ad-9109-a6b4a98596c9", "value": "768:mWuWOhERu/31/slD40y1fGQam2OC8oAPf73Jpos0sO/VCAWxp7bPxHokV0keYxb:mVWOpEW1GQBhC8oIpROfWxp3PxHoZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404636, "uuid": "dd1cd4b8-941f-4ecd-9a27-23a3250e397d", "value": 46360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404636, "uuid": "7e2f9020-4f04-403c-8c27-892e1466799c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404636, "uuid": "14bc5b98-ce4b-44d2-b2bf-0cfd995b11be", "value": "mini.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad27e92-9487-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786344395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "99351218-b4be-463d-b917-324b0d979977", "comment": "Malware payload", "value": "07a17db0788dedb2ed49576b34c645d4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "0143ce1f-bba1-44b2-9a0b-4693ce4d494d", "comment": "Malware payload", "value": "8b76fd02f22106d80147453a04a123c6a5aee8b5677d9fae1843b46008638c0b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "416f792a-b489-4ffc-bc1b-ab7b6e713be1", "comment": "Malware payload", "value": "6ec5343d33b8f17831f9664b877ae049be6b804d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "e02c6ffa-fda4-4f0c-a4c6-957e5ed81a4a", "comment": "Malware payload", "value": "b861bb957bc096375cd09bef13785fe0b71357155e870abcadb575286ab8cf957ed2e0e16c71686661f2a4c3cbd5e5bf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344395, "uuid": "40628af6-3e98-4475-bd91-1b8922b8e52c", "value": "T1643207CCAF9063F4F29743CD27AF299D136561CB504CD880F68C6DE06F4B68D4A86E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344395, "uuid": "fc06cc64-4f1d-4e3e-bbfe-666bc68a972b", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfMnJbl9CX:sXX+/DV7k/3/lLAiYOpzEv9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344395, "uuid": "01150afb-e2cb-44d7-8386-c004a0d2290b", "value": 11935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344395, "uuid": "2111ecef-97a9-4cf8-9f01-e173dc5511b7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344395, "uuid": "f5c65f64-8548-457e-9a97-850be82dcb4a", "value": "cy4509Report.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdbdb82-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786372696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "86193e72-0821-4975-8e64-fe493db12406", "comment": "Malware payload (RemusStealer)", "value": "e8f8eec7a53912e4accd0cc821f0876a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "31c33987-2afc-4f31-928b-e3095b563fe1", "comment": "Malware payload (RemusStealer)", "value": "8bb8f109254d65c31232d0dc68a37fc2832bd919eff95d7fbe0b2a7317c1e1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "4369c33d-1264-408d-a83f-6d2f9afedced", "comment": "Malware payload (RemusStealer)", "value": "de54455a1e4f9816d725d3124f49227883da50cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "399c2cc1-0f8b-4c4f-8b81-6d3bb4b78960", "comment": "Malware payload (RemusStealer)", "value": "8c0f86f3314b640491d4260d6c9611a1fb6cb7905c7cae6a1a76c0e3b437a3e81bc827358ed81a2fbe39e49bb1074886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "cbda92e3-e229-42c3-810a-64ad74dff0ef", "value": "T1CCD54A07FC9149F6C099A33189B29256B775BC090B7233D72E90AB383E767D09D79B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "e3e8e80f-fe6c-4c81-9eb6-1f92ed31c65a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "48851342-962c-4ded-babb-29596ecb0510", "value": "24576:O5HW7bI8o8p6kPohIHoConQvfoEqXBR6YXW6Rky2aso/9zk8vAoBele5I9DPKf4m:O5Hm08r8kw+HoCoufn4DjkfaxkPVDul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372696, "uuid": "e3e123f5-e29d-4f62-9dc7-8363397a3a2f", "value": 2815488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372696, "uuid": "c4d8439c-6f87-4a9d-b40d-4cf2ce29c2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "7142fbdc-ba1a-4e82-aa2f-25e4f6f8b8af", "value": "8bb8f109254d65c31232d0dc68a37fc2832bd919eff95d7fbe0b2a7317c1e1a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650653f6-9495-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786350479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "61e88f3b-1e23-4fbb-b02f-86bb7f72a774", "comment": "Malware payload (PureLogsStealer)", "value": "94c5cce8d37ad06a46fe80f6c4545a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "f02a06e0-7706-4475-b50d-ffe3b6be503c", "comment": "Malware payload (PureLogsStealer)", "value": "8bf9292268c54bff715ea2840a79a77e4d7517b0e3f825c0454cb3607cebc6ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "e6f9210b-d4e7-4f2a-9345-000c8979b522", "comment": "Malware payload (PureLogsStealer)", "value": "73de2d6a8a8b25816fa0f25bb20fd938d21fa856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "66461623-b8b0-47e3-872a-1bc9d0f958c8", "comment": "Malware payload (PureLogsStealer)", "value": "88a72ebb44892669882c948734abb87a2fa1b07b3d0348fa28cab92cc15dafaffc3f6edd598f1ff8bce9525d6b2454a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "9d2ca117-18d0-434a-9160-7e73bae39fc9", "value": "T1F17522BC6E5EC810ED990BB10BB1D37115384E8CE512C2A39FFDFDB77865B2A2844985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "a03f7ae7-d402-4d38-bad7-8a1fa030683b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "aff8fdcc-ef3c-43c4-a18d-9f5a45f086e5", "value": "49152:wAqU0q3rbbwhGjYCsYGsPh5T5FhUu0Ux5WN:7+q3rYGMC15Pn5FDzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350479, "uuid": "4705503e-4737-4930-a3af-b44749b53afe", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350479, "uuid": "c7c77e1d-8d55-47c7-b78b-53d1cb7b11c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "8e278b99-d85f-4d07-a258-ca1eb5be6e23", "value": "Email_20260803T003229_3124512.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ecbcc4-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "819b9cbc-be55-4b68-99c2-1466f1f366a9", "comment": "Malware payload (Vidar)", "value": "06766ccce738f33943ebd12342f035b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "78155301-d60b-42e6-b39f-7f2771abc174", "comment": "Malware payload (Vidar)", "value": "8c65fdf81f36fde8272baf6f993dbaaf5b1a75602b2dff7d6bc90ff91c965c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "fa1c2104-efd2-4d90-b248-242120b59ae3", "comment": "Malware payload (Vidar)", "value": "b5d682ae0d9bb0c9b02a6bb6414e973189465840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "e3c8ef24-e299-4400-acc6-179ddcc1221a", "comment": "Malware payload (Vidar)", "value": "969625b123819fe08c36bb6c3ab0ee528b0e881ae6cf4c4f9b0b9a3bbac579728fcd99f141e2771ac552ae364755616a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "1cd39c2a-069a-4d6a-8ca7-5175ca3ad2b3", "value": "T1D85219DAF18372F9C0EAC339D7161377D6B6348D170A2BBF96D8D6A829C031039D8694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "bec8853e-58d7-4b8d-980d-d50bdf337b71", "value": "1bbed67eef2c885e172f4ab0f7e6b4df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "9d4ca89b-bca5-4e65-a5fb-11c232a1c59f", "value": "384:OjCqraQkgqkfUuTU5sNzvzQdeyeTlDNfDZ:8CvQPUuTU5EXQd7WDRDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369079, "uuid": "8391c603-ba8a-451b-a5fb-cfd117412298", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369079, "uuid": "1f9ed1e5-9c0b-47af-9080-e59991a060f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "62faedf4-3c09-4034-8457-25d6f6275ece", "value": "8c65fdf81f36fde8272baf6f993dbaaf5b1a75602b2dff7d6bc90ff91c965c61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac5417f-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "6046d6e0-9105-4a75-ac46-224055d4983b", "comment": "Malware payload (Mirai)", "value": "3e0bd3a985bc9e0937b35c99e92173fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "41766ce0-cfc8-4af2-a00c-35d9dab64358", "comment": "Malware payload (Mirai)", "value": "8c95dfa95220071f3984c3158ee101597f53b6a1d1c092d07ba852f3ff37089a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "570aa843-d48a-45fb-983c-2d43ba0c2bb0", "comment": "Malware payload (Mirai)", "value": "bfabb344588f43940ace42df3416eece7d1d2e4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "a91f49b8-e460-4727-9f8c-2f156a3edb07", "comment": "Malware payload (Mirai)", "value": "ec3d8027b05e44059ca4a3edd3591ffede9e05fd31447f56edacd8527d0ec0dfb31a7768aaed5a6f916169138dafb4d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328315, "uuid": "f06fbc05-5b0b-4065-86db-3d847bd01080", "value": "T14C83A61E6E219FBDFA68C23047B78A21979C33D627E1D685D29CD6001E7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328315, "uuid": "d055df7b-1a5b-4711-b5c8-089e84289765", "value": "1536:rYM+VffRbU4YnVviHdy9BeBcwCcTgee8ns5RSld641Ri:rD+fpbU4YVedEeawz2zEd64y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328315, "uuid": "f5c3bdbc-a7bf-4397-bbc8-15eaefe6a38e", "value": 85188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328315, "uuid": "5a2a58db-dd7a-4a78-b490-06cd15b18e1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328315, "uuid": "d201a87a-744f-4c3a-919b-dfeae204e4cc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ea52bd-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "2a364fe7-6b08-4279-bdab-e91fe849be3b", "comment": "Malware payload", "value": "848a746701f2be308d8979659b1fe23c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "80f63a78-55dc-48db-b036-deb9816485be", "comment": "Malware payload", "value": "8cb2c2eb8547b2c260f4ab8facd603e2bd3ed4001119e708501acc3394e0840e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "c526506a-d0da-49da-a5cf-7caa74a37bbb", "comment": "Malware payload", "value": "2bb03598e9ad4eef66e688c45db0ea0afce40957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "8cfe42ec-d914-4f9b-9996-9178ed6ac2e2", "comment": "Malware payload", "value": "9c38fab26d171a557140dbfa8f50790b4f6277103ad7dae6829622d7d579552b4033e4eb3651a7e90a6c8099f1ee0828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397379, "uuid": "c3a4fbc7-a58d-483e-bc33-3732f8252faf", "value": "T1A213D882F347D922C40A193567BAC776370279F61F66D2108D65EACCFB6B6C0A9B1423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397379, "uuid": "c8206ee2-3ebc-4050-abd7-f1c76bd4273a", "value": "768:evsma5fs3nd1LMDuF+/uASaNk2qh6Y9QRDDvoWwyOofUEuGlAbihUvf+wGatzFaO:e0pNkXkJ/cEuJnvfVzFaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397379, "uuid": "b8453a52-cfb9-4a1f-834d-544580631af5", "value": 44484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397379, "uuid": "78328d4d-b11d-42e3-b632-a2cbc2ea8355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397379, "uuid": "1c379d7b-383a-4ae1-8f64-9feb8a04f20e", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eddc3c5-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "aa26e485-dac4-46fd-82e1-5328d7f690c6", "comment": "Malware payload (PureLogsStealer)", "value": "85efc9ec248b184396328f830e18876d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "531663ae-8561-411b-90aa-cc32da5b5091", "comment": "Malware payload (PureLogsStealer)", "value": "8cc5ec8d9d99816bcc21534baecacf44630d23b788da4d90ff298ce061202ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "1a18928c-d2b3-47c5-9008-7d99c5f0c6bb", "comment": "Malware payload (PureLogsStealer)", "value": "c1dfb9ecafb4ebf3ae55b27c367d385d10b03ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "98a61131-24f9-4a01-84c1-37d38fb2992a", "comment": "Malware payload (PureLogsStealer)", "value": "8f247b354252cfb16f2f61c075d63de51bf8a08717daac68e3f636b13ea43068ba3ae642c46b20639dc79bf1bb737afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "1e00d5ab-b36d-4bc3-a863-f09f754b326b", "value": "T1B77512591712EE42E1DA8BB5BC60E33432704ECF79E2C3825FE99FF7741A3916958281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "9be3124b-9dcc-4ef0-980a-2430c4c90963", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "324aa089-7004-4ab4-a27b-ac37e357f6f1", "value": "24576:bp5069ln+UHSebfEzELoAO0H1+SxnjC04Qea3Sok7cnr:bpRnnZfHLGqjC2eai7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373339, "uuid": "c2f4be1e-ddda-4465-b70c-ab198525bb6f", "value": 1671680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373339, "uuid": "1c8cf2c5-d3c8-4f5a-8f53-ba1304102da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "3d623641-af3a-4f5a-8cc7-2fbc090e580d", "value": "8cc5ec8d9d99816bcc21534baecacf44630d23b788da4d90ff298ce061202ae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7420080f-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "30aaf1ee-a27c-44ce-81ae-a2c641486c11", "comment": "Malware payload (Mirai)", "value": "cab076bc0796c0d2d30d17bd635416bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "f0abacf8-3126-4f71-af30-b0182eac8984", "comment": "Malware payload (Mirai)", "value": "8d5e98c7fb4244f8f61743f04b42b514981b71c40387adfdc960207ee2e4bc16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "13e37abc-37f9-46a9-97e1-d26db61171fb", "comment": "Malware payload (Mirai)", "value": "766b7633a6122df925fe45afed775b2e58ed248d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "4d311104-d937-402b-ba0e-5483e84a7f20", "comment": "Malware payload (Mirai)", "value": "2e441ab040cd0ccf38dbf76f736083160fadca73256d514d0071fad0db64532ce3c6adf3e236771783707265c495bde2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "4d3f7ee6-171c-49d2-99f1-b1219e58560e", "value": "T1C544B71E6E228F7DF369877457B74E34A76923D623E1D580E1ACC1101E6438E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "87b30d12-5dcc-4250-b6d5-4fc327247df9", "value": "3072:up8GOCrKWVqw0x1QRugN80WxbfdGUmL0O43zbSIsa/gLrugP+NszaKBoePiqi4CH:upHOCrRVqY8jxbdZfQaESsk6iFL1bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356946, "uuid": "a8ae016a-d1bb-4737-aa43-ed12dabb8282", "value": 258580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356946, "uuid": "c633ef7f-a110-480b-836b-fc423ebea00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "5a1d2c11-6447-43dd-9a97-d7de18058550", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72761f51-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "0e177cd1-44b7-41b1-863a-d678b0a7c843", "comment": "Malware payload (AgentTesla)", "value": "583b2fee229b1901d8816baaaad51fc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "75555dbd-46ab-44be-8902-5f91c91bd0ad", "comment": "Malware payload (AgentTesla)", "value": "8db72555c4fc52ae7a756ab9868af1e372e06e3ad07ed1b80a06e0f5351f28e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "e15a8811-1dd4-4d88-9d4e-9c7ee3127b8e", "comment": "Malware payload (AgentTesla)", "value": "ddca1e972425dd576c8f144ff35c26d2d1133c8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "7016baa1-b578-41e1-a1d0-c9a4d1931b6b", "comment": "Malware payload (AgentTesla)", "value": "d6e84e79bd69b36fece73421ea298bfae75718f37dd1d97a6713e19d65d298fb0020c16d9c95bd4f6443d7bea3a09389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "056a77da-e080-4650-adc4-39c8633003fa", "value": "T10744011637D1C87AC4A20B71C87655FA5628DEA8D93387073791FE6A7E312C28F0E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "deb0dbc0-15ae-4200-8cfa-9ead19511ff4", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "23014c4e-f8b3-4b83-8da0-4c66407d3ae0", "value": "6144:LB+pgU8O2WlqNhtWMZg5ecBuj0fi+ZImQALScO:LgUOxlCnW8gYJeHZIZAxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372835, "uuid": "7dd0ff1a-9ed3-4460-8d70-9f4f63628683", "value": 275760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372835, "uuid": "cb8e012b-9c72-4d63-9efa-450ae292b7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "14918963-e246-4262-866e-bc848d5d1919", "value": "8db72555c4fc52ae7a756ab9868af1e372e06e3ad07ed1b80a06e0f5351f28e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9ddabe-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "143e0006-5b7d-405d-b3e7-baa4e33d43dc", "comment": "Malware payload (RemcosRAT)", "value": "6a2e157bdff4f7965a7b5802fee03275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "85b459d6-5ac5-4dc2-8760-b51bf972fc6d", "comment": "Malware payload (RemcosRAT)", "value": "8dba8da0a8c596b4f3a886f95c57bdb6d8b046ee356d3c52555c3bc3fb0cd114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "da211d99-9494-400a-b1b1-79443120d3ca", "comment": "Malware payload (RemcosRAT)", "value": "06c299768beea4860ab2186d64e3f408bfe0da08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "a222ae4d-6cad-4725-a1f6-029ce661bc97", "comment": "Malware payload (RemcosRAT)", "value": "ebfe43e1edac28368cde060ab7b789366554da3f029cbe19d69e6be8e675e7ac38ab9b521d2907c0eb061974d91a6b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368715, "uuid": "7c65ebb0-c3a0-4ef3-8c05-f08a5c25dc30", "value": "T105651250E66CBDD4C97642F419BAE6304079EF2ED06E86199AF47C573AB16C330A3E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368715, "uuid": "33eb3eff-1b7d-4222-85cb-182aaa965491", "value": "24576:VlgQ40GNwzZvLd1jQkoeczbXYgjluRb//mik7EMPu51dCsTuJ/7TNbfq1OvnCis8:V6Q40BhnRofzjYgj+b//L4EMm5Csq/7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368715, "uuid": "1532b424-4296-45a6-ad8c-361ab2a7301e", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368715, "uuid": "113c45b1-5504-4bd4-8b4c-d1ba873cb899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368715, "uuid": "7111d012-dcbd-4a17-9099-7b3107e22501", "value": "8dba8da0a8c596b4f3a886f95c57bdb6d8b046ee356d3c52555c3bc3fb0cd114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf613c4-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "7397a780-07d7-4448-ab69-f80ce5f90fd1", "comment": "Malware payload (Mirai)", "value": "c3d6d6740564034cbfcd0730bab9a977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "13f47974-c76b-4be3-82e2-deda6078ec45", "comment": "Malware payload (Mirai)", "value": "8dfd5cefc9c20988abb1188f250724f4fa3f46f74f1e4e8c0569b38cb0320d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "c5094c69-9802-4562-943a-e506288e4595", "comment": "Malware payload (Mirai)", "value": "263848f64215645cc751b3645dff955d6c6d7359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "14510688-2854-4223-927c-dbd0b56ac1e1", "comment": "Malware payload (Mirai)", "value": "c05b187043b5d87ff43997c714c558891692b051af20d9f5627807463f825b9ee4d84f19097e090442046506eb7647c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347187, "uuid": "eafa7347-1f3a-47ba-9d27-0d0002748851", "value": "T1D0E4CF9673556D3BE0A79F3F84930B12BA36E78046C337172129B6346D336B86E25783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347187, "uuid": "962e8074-4e4f-408f-a759-69ea4e9ccdd0", "value": "12288:1O+2Z6ZRKvbqJoynt8GqtI9oblHqvQdqWkMN/mnLhVnTwsZvMWyg9WaTC:4Z6ezOoyD9eKBnlVTwGfyg9WaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347187, "uuid": "2bf21d8c-e65e-4ad8-beb0-f6e9b6563afb", "value": 661572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347187, "uuid": "a09dd196-3c6f-401d-8840-69c2a8904a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347187, "uuid": "aefcdbb0-9941-4752-990e-98b62c18ae34", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69a1276-9491-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "4df3a074-081a-4bf8-b478-b1f449f54fb2", "comment": "Malware payload", "value": "d0d8fed17497a83e9da92c8522aeff19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "e10944c6-8ff5-452a-ac79-39a2d21f302e", "comment": "Malware payload", "value": "8dfe259d2c6f6005887f2fa978f0c98a6713de17d90311b5919adbd9ad3ae190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "ea9d305e-b7d1-40fa-a4a5-e793746cfc44", "comment": "Malware payload", "value": "0f87be817dd57e1bcb13da2067ce2a9600fe8ea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "1ec80b8f-ae51-4b1d-af70-6666b788ffb7", "comment": "Malware payload", "value": "20a0930b477dc95afa3568263863bc0fa020fc6808b1a52b89058c4367f6e8144e69620041ddb43fc511d13dc764b9fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348978, "uuid": "ed05a33b-ca1e-41cf-b3ee-030525102c6a", "value": "T1D463E9099E15B9BBC08E4E7845BFC09204D63DBBA3D5833975E47A9DBF3C25902C3698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348978, "uuid": "3531132c-d744-4bfc-afea-4093b3cbbd14", "value": "768:oIAWciMXbWvr+mRtzrQgIXkRc527v1ZGvCiGQ:oyfxQfh27vPLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348978, "uuid": "cab31495-ef3d-415d-aea3-7b9a14b017fa", "value": 72884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348978, "uuid": "f9249e7c-157a-4f73-bbfd-5f6c136f11d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348978, "uuid": "1c244419-791b-4b88-be40-19c76b1ff2c4", "value": "main.mips64r6el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400ffc00-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786355571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "7d81a068-badf-4eac-bb60-909bc5394fdd", "comment": "Malware payload (Vidar)", "value": "b24376060623dd8dabec2c3dd423361c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "562b5efc-f04b-484a-9af1-c23576055a09", "comment": "Malware payload (Vidar)", "value": "8e5e251d971957c982721ef54328000815d80c744f184fac3bb1afd64dd3624a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "1cdf1790-72a2-476a-b49d-fc92325c3cd7", "comment": "Malware payload (Vidar)", "value": "2f7c74580c7031ba7d9ad89771032eca0ab61758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "7f698af7-6047-4aa1-bf5f-4a14dab2b237", "comment": "Malware payload (Vidar)", "value": "3745450b52dabd2b21ca49431f8205b6b61feb8e391bcbc891a585e9c4e03d145898b56e0d7e2e80be53422bf03b5232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "b0fc3132-cb6e-4eb6-bc18-76c9f4b5ba45", "value": "T19B067C03BC9149F5C0A9A73588B74652BA74BC495B3237D72EA0BBB82F727C09D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "c3729b7b-a1cc-4bff-9121-693b3a9d53e5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "ce47005e-22bb-4ac0-8c30-e68f3c206216", "value": "98304:bPbAHF0b2LsXfAP0xZoXriQPZvCjMnV725p5NnkVIWsEfZw4xToOtz++W5OmaRUt:bya+W5Gktp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355571, "uuid": "3277d27d-7415-4e49-86ec-d4f8ee825a7f", "value": 3699064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355571, "uuid": "ed9f1eda-8f87-47a5-b8f0-f3b2abc1fc0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "47e32f79-6502-4ec1-a312-1b8867134f4c", "value": "b24376060623dd8dabec2c3dd423361c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b231760-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "4aa5384c-3ebc-4d32-9203-b26ffc00f8ef", "comment": "Malware payload (AgentTesla)", "value": "c8e3508402e2117567e8b0665ef86aa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "98c96186-e8f1-468b-9e4a-5e5a3a15b01e", "comment": "Malware payload (AgentTesla)", "value": "8e607bd17fe6bb0972cae7c1dd4720010f277705194f86c69ec77097c67a52e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "58c4ba8a-44dd-4de3-a870-803f64010651", "comment": "Malware payload (AgentTesla)", "value": "007fcbebcb9cce83f585ed23577670c066dcda4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "fbf1e359-ab5d-493b-a627-9d8290ff1893", "comment": "Malware payload (AgentTesla)", "value": "59ec800387c3ab307cb174aaf17e4f81efbb2e4f5d7a73153289d470a0eba9d72b9337c02babb8333b3900232bf7e37f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "9a46ac0f-6092-4de6-9f8f-6c52eb767547", "value": "T198350245335AC812C5C7AFB05E70E3B405794E98B811E773CEFABDA7B87A3866D01291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "7b1dc766-a877-4859-a65c-8cf9d54cf380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "24d7a7fb-81f8-4f2c-bf5b-26097f3ad504", "value": "24576:c9jR6pFsRss47ZQKXW1ixC75glOudZbIZprzsmtIAa3zjuLF:6timRss47ZfXGWC7NudZcZBzsmGZzj+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370970, "uuid": "651d8c3d-6303-48e4-a619-dc4253fe1d66", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370970, "uuid": "213aaebc-159e-434f-b60e-54adef311d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "9d945a3f-0723-4ccb-8e9e-c5d7e2d107a7", "value": "8e607bd17fe6bb0972cae7c1dd4720010f277705194f86c69ec77097c67a52e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e1245a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "8fa91ee4-1497-42f1-8c49-b4ac2a97034d", "comment": "Malware payload (Vidar)", "value": "63b575b239158d51eb18db9ae81a16a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "3bd55cbc-41f7-4a01-8914-73a86c416266", "comment": "Malware payload (Vidar)", "value": "8ea2ff143ae5e334c59c65918271c06edaabba7175408daf950e073ce93ce861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "9863d985-6228-4e63-8c67-4a9807d7cfdf", "comment": "Malware payload (Vidar)", "value": "6bff687d583a4c6f2dd5d6467305a76aa9a76a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "d7b7c2b5-96a3-42eb-9672-b5241b36ae00", "comment": "Malware payload (Vidar)", "value": "d4887676d9227f8fb175ffeca03bde6763dee318215daa13d9b669f72628422f67ec8f07066bd09e5100849adc592830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "080ad73d-9fa1-4f26-a3d3-709fada84e63", "value": "T1B0421BD7B19770B9D1A5C2FCCBA716BBAB267080030B1FBF46F892845BD261066B4618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "4c31b034-7a1c-4f0a-977d-e7691c12a80f", "value": "f6ed7a812e36f2c87231645354e7939d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "5cfba493-2a0f-49a3-b258-d98cf5535d2d", "value": "192:7X9YRDdGPmn0ovxWEV/mz5jRFpLlcPGD/Ut3N9pJqs30s3VZpCYn:D9oD2mnVvxdmz59F9/Ur9OsHlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371101, "uuid": "528db163-d855-4332-8c72-ccc97e649129", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371101, "uuid": "dfae9724-20ff-49e2-98b5-d04bd383589a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "858601aa-ac82-449a-89c4-84e3c3d9f2f3", "value": "8ea2ff143ae5e334c59c65918271c06edaabba7175408daf950e073ce93ce861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b3c2c7-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "fab9985e-efff-4bb6-929c-267223505652", "comment": "Malware payload", "value": "aec8956e1abda9a15f5217b073d1c1eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "dee337af-026e-4891-a3bc-9e2bf2dd1e1e", "comment": "Malware payload", "value": "8ea859135c8fe3f92df9ef2409e6f87114050f9336cc75132c90857d619df665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "d7b8b0d8-d73d-486f-ac53-690f4580160b", "comment": "Malware payload", "value": "69fb184a6dae43441a32f2d88789bc84bb45cad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "65387b77-a5ac-4897-a363-c657a1daa492", "comment": "Malware payload", "value": "005157fa6c15f2400cf298726fae4d94c3763531115dc4d52ee53955f27f31e954b441dce2a9504a616e2f1d31943a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397380, "uuid": "e227ffa9-79d2-4c25-84ab-e2b7ce8c918c", "value": "T11B25AE533BF61465D6404A358FE2D321B20AD7A874D54A4B9FA08EEFDF032651E82CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397380, "uuid": "ed60f2c8-6e23-4501-90d9-e08d99ee9deb", "value": "12288:4hMNCDpIW1LfS96SvNzF8zlyFtcIaRava5dCYSh:HNCD1cFfFKBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397380, "uuid": "4e2ac5ab-386e-4000-ab59-1de23d58bae0", "value": 1057088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397380, "uuid": "c3ff0c2f-c118-4f75-90a5-d786b8660baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397380, "uuid": "96db8617-6ebc-40f7-a5a9-e64515d25b4a", "value": "main.sparc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9872ca9-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "606add81-5408-4e15-b3c8-412ebebb0b65", "comment": "Malware payload (VIPKeylogger)", "value": "488e7b9bbb2b6de4dec92bd97824749f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "69651553-0b73-4abc-bac8-c37fe72eb3b6", "comment": "Malware payload (VIPKeylogger)", "value": "8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "8ffdf0f4-8272-4f63-8a38-e05fb4def7be", "comment": "Malware payload (VIPKeylogger)", "value": "d678724fb4fb5b3b66650b394c4ed6619987ce18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "9b4dadf6-cf87-4a4c-8b84-b8ea11acdb74", "comment": "Malware payload (VIPKeylogger)", "value": "7205fbf90959e6dc73bc9888bc69dd2ae9431f08485af7bb87bc017c966df405b4eeb7a0d75a1cf391d7200e085bbca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373062, "uuid": "ccd1949d-384c-4da9-a711-6c560e34c75c", "value": "T124B5E820BFFA5874F1BF6E21CEE7B981D7EB7F725916854B2112170B09B18098F42A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373062, "uuid": "91136d77-394d-4e84-a612-4b337661c632", "value": "49152:anfHZ6Mj1gw8ul68qoRN66KUdZnEJh/Suy:anS6hdZq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373062, "uuid": "56668516-61b3-4365-8fdd-f7bfed3a6657", "value": 2449920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373062, "uuid": "7b9e6434-40c2-4ca7-9ebf-07938ec1d5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373062, "uuid": "23e449d2-dc52-44c7-8566-b2be3e0a8c97", "value": "8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bce766-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "f6a46169-d1ab-4a0c-bb11-5020bb761f1d", "comment": "Malware payload (DarkCloud)", "value": "5ea237b0675adf0432dccc7a4468bed6", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "09efa313-aa0f-493f-afce-75ff94c4e36f", "comment": "Malware payload (DarkCloud)", "value": "8edb49c430bf31464b8c083502054e7efd0de69c0fbce6681a2608109b6c1421", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "19ba6ad7-4d06-4f81-b03e-f72e5a1e2658", "comment": "Malware payload (DarkCloud)", "value": "f579d99d6d5870b3f36db57101cff3d8dda97f29", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "138ef8aa-2522-4194-b174-46beebccc034", "comment": "Malware payload (DarkCloud)", "value": "f4208bad1800fc53de56f386af2b6cb0063859adc59c3dfdcb8ad90d7f63e671c3e438efb167a6cc76605e0b6fa018ed", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "2ccad0a4-809f-4633-8228-9e19a238da0e", "value": "T1F555F0C5EA4496A1EC59ABB16A36CC3043237DEDA934D41D2DDE3D6B3BFB7821020653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "05e4f37b-6880-42ad-a3c1-7f702a102f25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "9a6b702a-6606-455e-90e2-9da1535d59d2", "value": "24576:+N0cCUb1ogjuE1165RLvtXR3GNj+WakinV+RMSe4ft7k9+gZ9L1q:3c7CgayUr5Xdy+WakinV+RMr+t7k9bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373753, "uuid": "f73b179e-37bd-4623-b514-1e6f49168836", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373753, "uuid": "e4bd00c3-5bf1-4318-a527-a087a843b876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "c615759d-50f2-49c8-98ec-c6db143f244f", "value": "8edb49c430bf31464b8c083502054e7efd0de69c0fbce6681a2608109b6c1421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a121646d-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786345855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "7c6de735-04d7-463d-8029-a023ff9c5bb9", "comment": "Malware payload (AgentTesla)", "value": "486c3cbf1976b08a784af128b2cb6875", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "36447e20-7ec7-4e14-bf88-878037e4fa6c", "comment": "Malware payload (AgentTesla)", "value": "8edf0ea4a9fe03184d6525155b5ad60dd519faed49cbaa83b3103520d068b22d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "65ca4afa-c849-49e4-914a-71abda19f2ab", "comment": "Malware payload (AgentTesla)", "value": "44bff936d483cfc09cb4fc8f6db26904065dafd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "5c7af29b-e24c-4cb2-b605-fb6ed9e7883c", "comment": "Malware payload (AgentTesla)", "value": "36522b550c37e2991b15eb09746a331068b0c0c3260cfbd687afefd7f3fec1b3e4aae830afcaeb17dc34f5c4cb133406", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345855, "uuid": "440f31bf-b0ea-4dcf-9aa9-79d2e18289bb", "value": "T102E5B3425780AD727725ABAC523ADDF0D90A510319C5DF16307CF218BB6CD1BA7A8BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345855, "uuid": "0a7368e7-ee95-4da9-9565-7aad0252596d", "value": "49152:ISYe9PlrUdsltCJQIFzNjofQ2bUDKuYrVwyxgJknQOthFFEEv1glF68zI1qggHkL:ke/AduCaIFzNjmvKKuYaugJknQOthFpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345855, "uuid": "e242e3f3-f67c-4ac9-8af5-0d8993cd3157", "value": 3050654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345855, "uuid": "d52cf32b-2a86-406d-a3ed-099b36cf46b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345855, "uuid": "bcd7e6a4-fc99-43ba-99a0-3fc34ad988fd", "value": "Purchase Order - PO-260311305 - Payment TT - ETA.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb6e8db-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "0f9c3ebc-d2e5-46e8-8f1e-ab0615614930", "comment": "Malware payload (Formbook)", "value": "8f066542f2b0ed6af2ad95e71a771ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "c8a2eee7-ef1f-4d52-82a2-b63eff87ee07", "comment": "Malware payload (Formbook)", "value": "8f596a7798dfa8460b1b46881bf7362c7f714978aa4348da0d248aff75768363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "4d35723b-f9c5-407b-a546-095302fda489", "comment": "Malware payload (Formbook)", "value": "b395d6a92f53a29f2064f33b558775efc1f2aa74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "33fc71ba-9d1b-4a1a-855f-e67cb6f2777b", "comment": "Malware payload (Formbook)", "value": "8376db2faa9e605649dd6027da207072732c6417e680c0dfec175d646719f954f5c2e6fe2f7156f688440c6c24dbb240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "530377aa-dc1f-4dd6-bc45-e491e54f9eb8", "value": "T1373512249649DD02D1E60B30A860E3F502F67E9DE821D61B8FDCBFDB7932306AD54B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "12a77ba2-518c-498e-91d1-9b146787beec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "b8d1a0f5-455e-42bd-b2ce-2d90fbd00e74", "value": "24576:AoOI3mBDUzMCLmJpehoUwhTWF8TktkuMFdf:bV3UUgCSJCmTZktFmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370710, "uuid": "67c83d00-25f1-4e41-9471-cfbd83885e98", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370710, "uuid": "fbe0023c-5c75-4486-9a41-f51238d377b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "99ebea99-5788-45ae-b207-93ea692619ad", "value": "8f596a7798dfa8460b1b46881bf7362c7f714978aa4348da0d248aff75768363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec462c47-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "0baa1689-82f1-45e3-8c56-b81de40c91a4", "comment": "Malware payload (AgentTesla)", "value": "b0dd6c8ee042b326d6c0ab108c0bf6e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "f8cb047f-9bad-45fd-bfce-3e81dc8ba96e", "comment": "Malware payload (AgentTesla)", "value": "8fabd6235dcfbe7bf788cc58d80107727bf60e2b3410aa50b36f98659dda5c37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "ec6f6e82-1d93-492e-9c65-d3bf49935e6e", "comment": "Malware payload (AgentTesla)", "value": "1eb1baa433d9de5098c870683eab3924aa111728", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "c80e9832-9e72-4acf-986d-4eab977e1de2", "comment": "Malware payload (AgentTesla)", "value": "52cc4c3204b0f9aed10776fe11d5746bb48c3a5a042830f5580758bf932ae6528a46dfe8422447de219a3f52c66c1914", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "7870e570-8d95-41e0-bb86-e959c30577cc", "value": "T1B125125CA608E503C8861B784EB6F6B512AC3CECE951D7139FE96EEB7D36A015D402C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "10c72393-2085-487b-8e66-c4edc12d4870", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "99d35dc6-e333-4ef9-ad49-fe1765ee516c", "value": "24576:4+WsGXTDCAql13H7SYGHMiAUHWQPJKh74xuVqA:WXXCAKeYkA+WQAh74oVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371321, "uuid": "0487af63-efb3-4737-88f1-e93f6600697b", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371321, "uuid": "cb18b0db-79a7-495a-b5f1-2c3548865a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "1d2eb048-f1c1-4052-9131-37f021eaf83a", "value": "8fabd6235dcfbe7bf788cc58d80107727bf60e2b3410aa50b36f98659dda5c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac66476e-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "a5ae810b-ff4b-40bc-a5e5-65bb14a3780d", "comment": "Malware payload (Vidar)", "value": "3f8c4f0db988a8f8cfe871f20860e786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "a9183745-8319-4e6f-88ad-541e3a53c825", "comment": "Malware payload (Vidar)", "value": "8fc6d927272afcca4607e07bb27f1634434848bb2ccd109f2bc79e61b9313f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "086a0059-fe76-43f4-8652-24efb70247e4", "comment": "Malware payload (Vidar)", "value": "e0bc8778bdaf23cd5eaf218278df1b9d6d6bb1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "97cfb48f-30c4-41fb-878f-83e80cdb046a", "comment": "Malware payload (Vidar)", "value": "64f87918cea05d9229f15b228ad2788cc12ab22a641692bf972d1a1d3163f05bfdfeecc44369f6b54d6933203a25bd9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "36af264f-7b6b-4dea-970d-4c6e460c5a3c", "value": "T15A320BC723D1E0F9C36EC679A9F511ADA672300192172CFF61A4C8952FC721273799AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "23e46e63-1dbd-4034-9769-a4564f91a365", "value": "4771e6f45e35660c0a3e9d4423dc0d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "d7bb6b63-1054-40df-a6b8-9bf24a59bbdc", "value": "192:OD9Cve/O2DR/ozqRDwthSgz+NhnnKwADij24P4CJC3VO3V:OD9C0O2dozqRa6N9bV4JlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369067, "uuid": "7fcdf07d-14f6-4d3b-8b9d-c73d10c58be6", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369067, "uuid": "56346ac0-1c2b-4e57-a6d1-3050360c2e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "e226e0c7-e59a-4b13-9551-4f6c43e70c10", "value": "8fc6d927272afcca4607e07bb27f1634434848bb2ccd109f2bc79e61b9313f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f611b4-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "7f5b96da-fd27-490a-9b7f-8b98fbdea295", "comment": "Malware payload (Mirai)", "value": "4c28519dd0e1049cc0f34b0c832e352c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "c533ed32-f143-4b13-bebc-c040ece5adbc", "comment": "Malware payload (Mirai)", "value": "8fdc0041414896914137bb860329706f2707ec88ca39be785a1c2caead84028c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "e1f185b0-4184-4c63-b9f7-85cd90426901", "comment": "Malware payload (Mirai)", "value": "9318ceb5454f7ef3cc2a668a9b7b2f491e40c4d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "b921b261-2673-4842-9a4d-ccf4959a8cc9", "comment": "Malware payload (Mirai)", "value": "dbeb3fd852ced4a03fcd217dbb175d083c7e86eea9078a19226f35aa500df9ef11d536ee9a6c805736440db9ee0b30e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339911, "uuid": "699041c6-547b-41d9-a639-a12c1a5c3052", "value": "T1D074FB88B5F2E2CED1D4EAB5A319784D3B630336B5D73145A50EEA3312EF15809BDE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339911, "uuid": "f3a757cb-59e5-4a90-9a49-f030b68fe703", "value": "6144:Pa9za9Na9KWyTUc7syUc5FlTY4+86uvphM4piqxxwYym2tp:Pa9za9Na9KWIbRln+KBhdVxxwYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339911, "uuid": "3bf8e081-e85f-44b8-9687-d4441911d804", "value": 363016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339911, "uuid": "a26eda44-88f1-4858-8630-0fde662a153e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339911, "uuid": "e4c403a2-10a2-4e1d-a5ed-ba6a0889ad76", "value": "bot_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf23dccf-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "6dc6d11e-efb8-409e-b68e-16b98343c91b", "comment": "Malware payload (AgentTesla)", "value": "9492000215d7c92a61434efa1a5a6d7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "ae708e96-1e43-405f-98ed-a8d3255da516", "comment": "Malware payload (AgentTesla)", "value": "8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "7a88d777-3faf-4478-bcbc-eda87c27a3f9", "comment": "Malware payload (AgentTesla)", "value": "aada93a043c4fd6953182da56031b1624473549b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "29e7653a-db40-4665-9f4a-54c43df3c990", "comment": "Malware payload (AgentTesla)", "value": "42ad28b920029da24c8ed896f1e0f6d4428416679d9db3b2861ad368713486a34f39fe1f4717aef5835d0ad1baf78365", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "0e36b7fe-4928-4b55-9ea2-11ef0006031a", "value": "T12CF55B70D351B065D1A7C430CECA4EF4A4A1303B52366D1F1BC5D91A25FBEA1ABAD3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "36bd5069-7f2b-4511-88f7-907d839f9601", "value": "97694f39fe306148caaada69136cf645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "df8014c6-4078-4f30-899b-4890c3fb1f36", "value": "49152:5MtK6O5+7JkgRNTLCOBR7OpMSr/0U3WtHHfClA9NSclaDHnz1hcW4uuqb:HYT3DtHRlarcwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370816, "uuid": "672a2a3d-c380-4d49-bdd2-15fa97b54068", "value": 3546112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370816, "uuid": "9e8df1be-6431-4963-901a-c40309a0b165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "4c143856-f4e7-4e75-a202-fdd3960947c1", "value": "8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b22da4f-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "ee046483-c169-41e6-bcf3-fcae21b290cf", "comment": "Malware payload", "value": "105d6a6c0c003182c1180088561a80e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "90e3b121-11e1-45d4-b399-3cad1b2bd70c", "comment": "Malware payload", "value": "901b53814a743b82744f72a295bb621cba81f7b54c2a30b43e358db606efa29f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "d67c8935-5b7d-4572-8a7f-3b8d2e7471ef", "comment": "Malware payload", "value": "33f08b9edd3de036f9151f2f28625927f30ea9a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "a7be9295-096d-4eae-ae11-2c5cb8478a1d", "comment": "Malware payload", "value": "b6c99fd833aac9c61b9c94c7359a6ecd1795406d261d4fcdc003ce9738cab781101e556eb1d808e6c769dbc4c81f1e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348422, "uuid": "1d7b0f1c-116e-4ee9-944e-80cb40712f49", "value": "T180F2E9E3C62A9FF6D106B4B055F1CD780B26BD525B1B1EA4A1368BE0024FDC8F185776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348422, "uuid": "ddeea366-37c3-492d-b855-27d9624113a0", "value": "384:Yy2XECZX1X3vS/zgVQLFLgRgoI2XdQC292qjoplOHiwCTkwyTwNoCwRAH/jE4Xs8:Yy2nDIgQuSwX7OHiTkwysSDR4799", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348422, "uuid": "a9859dbb-dc89-4fd7-b024-3865c48a4273", "value": 36632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348422, "uuid": "aed13a49-7ee1-4d89-80c2-35955513950f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348422, "uuid": "5dcf7eb5-d800-4130-b888-f656b21b0f9a", "value": "main.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fe94b1-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "f8cc9794-6295-41b0-82e4-885f1e9d8681", "comment": "Malware payload (PureLogsStealer)", "value": "cd7827aef25647ba17733b67290dba93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "a6013ae4-49b7-4597-a9e9-441edcaa40bc", "comment": "Malware payload (PureLogsStealer)", "value": "9025d2705a1ca25d0cd25490fb9a000c3495e12abfbf770d2313d729674cff26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "de20ca29-beea-4ce2-8291-2f4fa2bedb48", "comment": "Malware payload (PureLogsStealer)", "value": "7010cf2cd0d08c6c4f2788aa5b5254cbaf14d513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "4d1ec866-699a-4c92-95f7-67e16f1f394f", "comment": "Malware payload (PureLogsStealer)", "value": "cbf4860bf0efb0fc79ad3ce5270442f0196253fc03a5e62b6c7478c9e7e41e6dd3973ac6a222db80e827739b27e7015a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "c03fbd5e-194a-4222-8e50-b001e4f2a985", "value": "T10405AF2B76A18F21C3455372C1C3490187EA96876AB7FB0B329513E61D463FEDE4B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "71475c6c-2a41-4fd2-b3b7-d17f49677161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "48e66ac1-a7eb-4d56-8db9-c5b996cb62d2", "value": "12288:7svA/ta+jaN53u3jv3xEcSO1pTtjOji2ShkU3Had:7aK/aeDwO1pTtoVU3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373645, "uuid": "b08288cf-49da-44cb-bc78-06e3bb6dcc11", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373645, "uuid": "4bc9d47a-a2e4-4b6a-acad-985513b79912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "e9958daf-16e2-4895-8b99-7722cae11648", "value": "9025d2705a1ca25d0cd25490fb9a000c3495e12abfbf770d2313d729674cff26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e48716-9491-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "87694812-b8ab-48e0-8b9f-3f430ee0305b", "comment": "Malware payload", "value": "7637e951465e47f0caf9904193e5b4a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "9d6a0ee9-9a9f-4847-b09a-1cddbbc57caf", "comment": "Malware payload", "value": "9041c8f9648733b0a17e72ab8954eb2157d6b58cfc88c0c4a097b1c035d98fb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "81b5f997-5205-4960-ae35-0befa041c896", "comment": "Malware payload", "value": "1c7786cabe81282aaaeec97d7f86928dc0a28232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "8fbab663-c7d6-4e08-b2ba-faa33e0ee9f3", "comment": "Malware payload", "value": "a818c4a9dd3928db3600674f85002443982b9989a2b6331e66920b4fb0ce8587f4965d474bd10d69d06000a817859459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348603, "uuid": "220eb58f-3c6b-42d7-93a0-76fe11b7681d", "value": "T1FAC64A43E8A545E5C0EED175CA66D623BA713C895B3023D32B60F7282F77BD0A9B9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348603, "uuid": "df600117-c02e-493e-a645-b2a1ac1d925f", "value": "196608:bvQfVQ6eMqzbQk5ZqQEFgiJPWkzpNOiFCd:bvQfVQGkdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348603, "uuid": "3081de22-a91c-4617-8dee-f6b1c22e1fa0", "value": 11874488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348603, "uuid": "d3230585-7393-4cf1-89e1-b316ce498a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348603, "uuid": "e5351245-cc9d-4bca-94ea-ddca96bae63a", "value": "cnc_new_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b32e24e-9494-11f1-bd95-42010a9c0009", "comment": "Malware payload (Havoc)", "timestamp": 1786349925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "d3299238-2ea4-4175-aa53-f35217630070", "comment": "Malware payload (Havoc)", "value": "33d103a950e97fb4c0f28d8cff985ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "a4a658a2-1941-4878-ba1a-e26dab6f81de", "comment": "Malware payload (Havoc)", "value": "904bb06ad9ad3c8e4aa980b96cbecad85c14bd994af013d77121723c85a5e1a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "4704fa08-b094-4fc7-a103-c8ae85b97e64", "comment": "Malware payload (Havoc)", "value": "1441b32780ec0e76d09af693f62819c2d1ae8125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "e28d3b98-81f6-4104-92d4-e8ee04f0ed9f", "comment": "Malware payload (Havoc)", "value": "5b23350c019d581023451de563f4511ee5f4917893d0d98e9489e87fc02b8f3d9abd2c1de0b1fb4d927d892d30819e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349925, "uuid": "db956e63-3f8f-46e1-b878-570884ad159b", "value": "T123A3A603E2A720FEC4A9C1B447CF7232FAB3B45C21346A0E5710CB652F62AB1767D659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349925, "uuid": "19ff2039-6da7-4124-a05a-15cc08da7ec3", "value": "1536:mkJIalOYktfCM83vOpq9UVE/kGE5+Kb+LwoMSJZNx5FOItbl:tlITtfCM72UVE/kOXMSJZDPOItb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349925, "uuid": "3c4dbdd2-af84-4992-bea7-0f37cd2ee379", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349925, "uuid": "a7c811ad-dd47-4c39-8679-18cbb0787bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349925, "uuid": "e5dd3799-ebac-4290-a190-608dbd7a28ba", "value": "33d103a950e97fb4c0f28d8cff985ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4a0b19-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "a72bcea6-3fba-4225-a895-961411cd95fd", "comment": "Malware payload", "value": "46e169c562fe1630d68dcf7d5eab0a9a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "f1d0cc4c-d99e-4fb3-ba9d-17210d17c3f8", "comment": "Malware payload", "value": "90537caea3d5dd17e1dddab8fd2069dd1059861341a1d1f3691cfa35b05a5c3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "6c24b5a8-cddb-4ffd-bccd-b7c7146da2d8", "comment": "Malware payload", "value": "1e15205ea976af188eebca4732e7cf90355b70c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "0aaf285a-185b-4083-b60e-47bc0b355fce", "comment": "Malware payload", "value": "6cf4ebc0f7254858b3d876b036e5eea10b6cd4beb860eb573bbeafc1a68384de4424b3c5fe3ecda9be260dda78873591", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343186, "uuid": "c30abeaf-0188-41af-be16-842738693af1", "value": "T1D23145DF94152A351002CA8EB763314DF98E95FB295FEBE4DC490DD946483CCF2A2B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343186, "uuid": "084f1bdc-9102-48e7-985b-efee46530622", "value": "24:Jj/YdZZV3lbaHqVvFgOqNSuFaZlXQxohDLtF:mdZZV37IFaq+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343186, "uuid": "48e768e1-e44d-4839-8b48-e58361cf29e4", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343186, "uuid": "617908af-ce39-42f5-bbb2-6445500daae8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343186, "uuid": "c027af9b-ac29-43c8-ac92-8cc617fb66da", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbb7647-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "8744809b-751b-4661-b11f-410a6618f401", "comment": "Malware payload", "value": "b5f26924598c424b43d12297625a07c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "3bdca080-6e9f-422f-af44-457293352293", "comment": "Malware payload", "value": "90621d4c62352d4474dec776542bf290a07292bef9d5409b24ab0dc5b67d26a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "8356db5d-557e-43e1-8d44-1a82fa571548", "comment": "Malware payload", "value": "8b4649de88847122192b76864760f0ebe293b837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "36a0125a-d36e-478f-9480-074241542c9a", "comment": "Malware payload", "value": "13156e9d123d1bde9aeb14a653d10fb6e74cc66c824421b41102738b2b3bed5e24e84af391504b11f79d8a99f3063e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "f01e1561-8e19-4c4a-a5ae-6b3cefad0d10", "value": "T10D15F11923D85B54F87E97B89174054187F5F812E733E70E7EACA4ED1A62F818A22723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "ab8282ec-cf96-4c53-986b-b63c7a889c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "a842ff61-ce17-4158-8ba8-887bf063ce52", "value": "12288:7GM7ebB5kODVKaZuCgHebdfSK6bCMGPOr+e4ggVqfxNagXMPIx8yVADaT6CE:iM7efksxDZsTIPOr+e4ggVqHXOIGqmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368881, "uuid": "27ab7ee0-7f1f-4ca5-8614-37ea5d100c26", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368881, "uuid": "ab809a78-a4ec-4752-9d49-6aab23014701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "ba00c7c2-ed39-47a7-91ca-5b419d8c999b", "value": "90621d4c62352d4474dec776542bf290a07292bef9d5409b24ab0dc5b67d26a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb11e1c8-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786370487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "c99eb06f-f783-4b39-bf1f-d75c0d607cb6", "comment": "Malware payload (MassLogger)", "value": "dd827b4e97ab48b2160f7c74277acfec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "5eac4cdc-a89b-4ca9-9d4f-54afd416325b", "comment": "Malware payload (MassLogger)", "value": "9071f1cff857d0618511ce6aa6084c0e7e80c86ec17e8193a6b7eb990d350220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "67d7a272-43ae-4851-b9c8-6121867b362f", "comment": "Malware payload (MassLogger)", "value": "13c327699e7a9d204f26419130c1904ef4a7addd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "22a1f536-fa6b-4da9-b626-9bc55cea8652", "comment": "Malware payload (MassLogger)", "value": "85446293b75e47d0b4a29095a754f99b53c28c3b17ab150cbc41c9c27c572a1d318e4e1459e694a599cec5f7338e63c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "76d08bd2-953d-4838-94d6-d8c879f9e2d9", "value": "T14F25E1AC3A10F49FC883C9318A94FD74A6606DAA9707C20394E75EEBBD1D55BDE140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "2c676da8-1f65-4f80-b382-9ed6ea1d9a70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "263cbb7b-0671-4603-a7d5-ae6e347d2c8c", "value": "12288:d1CYIwiWpk1H9kWBgPESUt9iiCHqR7fAq0WAuZy9n0mSI7FUiCVLWiKjw1fTthFp:dnpkd9kuL9Ua89Sm/wWi3tYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370487, "uuid": "c1c3831d-9141-48e2-9d38-ca401dafd6f0", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370487, "uuid": "ed0122c4-3ee6-41d6-a030-4c2f337e7017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "14b4b41d-740d-42a5-a293-84bd6cef6d30", "value": "9071f1cff857d0618511ce6aa6084c0e7e80c86ec17e8193a6b7eb990d350220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5564912e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "3c63167e-dc4e-4491-ba05-b11b15610106", "comment": "Malware payload (AgentTesla)", "value": "c5dc6a44af7a7b465f7b356f03116fd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "bbdeb717-71e5-4d57-b5b7-71e63db42817", "comment": "Malware payload (AgentTesla)", "value": "907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "ea27482b-c8df-4d09-91e1-2a258b046a19", "comment": "Malware payload (AgentTesla)", "value": "a76894554c1da14d5a4355a20bda3b4b1911dac6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "7347ff07-a8f7-4bf7-b10e-499696831d91", "comment": "Malware payload (AgentTesla)", "value": "a01f6eba8ab607b66cdb9f3a98e5197a69bdfbacbcffb5fe1adeec2e5c72e1b7be780f0a2ea7ddafffeb679a5d3a27eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "02e304ef-1f34-4f87-ac4a-64ad8984fe5e", "value": "T1D02502982B5AD613C49497B80A72E3B4173D2EDAE401E30B9FDDBDEB763AF454C04252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "8e23a07f-872f-4356-910b-7bd3ab2f0c3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "5c9ee99b-69a8-43d1-8f4c-476dbf0469de", "value": "24576:5eA9sfIew0L0FxUhA8eQrT0UHvZI+LfC:gUsf7CxUhXrVHvtrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374075, "uuid": "5a50a762-2478-4649-905e-9289db961714", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374075, "uuid": "3f4ae10c-1c30-4d87-9f07-1e1c86595f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "0ddb38bd-b8e4-4019-b5e7-e1c77cb4bed7", "value": "907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a8d7c-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786369073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "103a4495-ab0c-46e6-a50a-35d718b08802", "comment": "Malware payload (PhantomStealer)", "value": "174f39d11536941a70fa73cb755ab3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "1d83df85-130f-45bb-ab32-abe58feec79c", "comment": "Malware payload (PhantomStealer)", "value": "909e69b91922647d3c73ec3ec2c0dfcd0fc4926633710ba2d5ff8a57e958108b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "0bb0e056-fde1-422f-8832-99068347a7fd", "comment": "Malware payload (PhantomStealer)", "value": "9f72107597df9104fdf80404a5afbb95fc021309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "9d4ca4c1-7ac2-46cd-8b85-0ea9a2df9e30", "comment": "Malware payload (PhantomStealer)", "value": "d5172dfbb5a68540fc1f2442aa665b14dbff2a98f8ae2a3868b344e3b7e6ce176cd2ef0b8c61e418565dcda8f9d41fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "9c9462aa-eacd-4994-a08b-0632094804e3", "value": "T12175231413AAEC06D1E61B700E61D3B412B95D98B872C3135EFE6CEBB66A789BC417D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "397d70b0-60fc-4b08-b516-9c7736b1cf89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "d0288dd0-e8bd-4046-82c4-2a64b26ea648", "value": "49152:AZg5MR2s7z2lBtDQNsJiCxbCSUyQHcVe9m4YZ/He:Aa5vUz2BtDIsIC1EnHie9m4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369073, "uuid": "aa340185-d6cb-4b55-9cee-f7e904bcaa17", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369073, "uuid": "555fb1b8-8e58-4893-bb62-2e7ce53ed261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "5f2d2063-d360-4f1b-a504-7f68433577c7", "value": "909e69b91922647d3c73ec3ec2c0dfcd0fc4926633710ba2d5ff8a57e958108b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b98ba46-9495-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786350490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "b5ec0929-205f-45c4-acc8-201dc464502e", "comment": "Malware payload (AgentTesla)", "value": "1b00808e8d58b136cd389361d01eb377", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "4c8c1956-3faf-492a-8984-3f14342bfe8d", "comment": "Malware payload (AgentTesla)", "value": "90b2ceb05b34ed6012d20b547cec83a2dacbe56659eb4479150f30015172c3c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "03429808-72d0-4812-b15c-267bb34e8f08", "comment": "Malware payload (AgentTesla)", "value": "3692fc83c64796ce846099f9dc651a9b2140c10e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "26d49c3f-72ac-4d06-8be2-c53bfcf2246f", "comment": "Malware payload (AgentTesla)", "value": "b6151fb201c22a57f675c03528fad1b53823a5736f85d7832e7e588c2242ae5ec5bd98428ca54de59a2f5c4499484bf9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "5c8baf14-70f1-4570-bf7a-1a2e46c1f444", "value": "T1BF35AD983214F49ECC57C972C964DEF4A7507C6AD30BE20390D73EABB93C95B9E141A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "bacc051b-6815-40ab-88d8-149143bed04f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "c48fda58-519b-462e-89e7-182af51b91be", "value": "24576:5RJ3smP3NRVXwZko1VLj7oshr3bdaqrX5Sk6zB97aQXYAn2:5r3P3NRVgpF0stbdTczH7aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350490, "uuid": "f517bde6-1aec-4e90-95d5-cec26bab0473", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350490, "uuid": "ee1a7a91-a270-4c5a-8564-3d5af3918345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "e8cf217f-2c6f-438a-8202-8eef8ff2e9c2", "value": "T. HALK BANKASI.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7e02da-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "e192d706-0728-4481-b61d-59c37132e29f", "comment": "Malware payload", "value": "7ba0e027b00b7147e9b9cb84919fc89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "8efb0e0d-7db7-498c-8864-8ddfe3286759", "comment": "Malware payload", "value": "90dc1e1670dce4bdb081ba2ce779493b761787881c9d6c84f926d054885e250e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "1dbbb794-b0c0-4e3f-9765-5378dd53ce0f", "comment": "Malware payload", "value": "9840d08d7da53700ffa4917241660e2fef702416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "9b77cee3-2ac8-4211-8475-8542fbffc0d6", "comment": "Malware payload", "value": "86d9fcc9d9f1b44da32341d67810988b3bf92f73fac9adde644321ec1bb57ff7b2ddb3621a321fc10192d3e5ead81d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "76ca42a2-5a0a-40b3-a98e-30d9b7d57b95", "value": "T1CF832935F1D950D2CABF72B874368BA6DB3493D556244208DA5CB8B93EFD3018970A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "f5c69204-de9a-4fec-a71d-0f3f47362d57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "d2d6a118-0366-4924-89c1-ee1c65b58aac", "value": "1536:jcb/4ay7OKnmO9cEURBNwC9+S7XVTy1PJe5a1DIKxJVzpArePK6CtTvJsANVR5:jcbXy7OKnmO5UrNbUSrcyjR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368850, "uuid": "35b9f547-fdf4-42a7-8856-2133a2691798", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368850, "uuid": "9c939ac2-c845-44c4-9d08-f84c3b7944cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "09b5e719-0d56-4338-8454-bb52bdfe980b", "value": "90dc1e1670dce4bdb081ba2ce779493b761787881c9d6c84f926d054885e250e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05a4c03-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786370442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "29fab77b-80de-4671-a935-17661e65b695", "comment": "Malware payload", "value": "2ee1d7416a1d1485b5818dd9258c8a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "a3813d6b-ac95-403d-b283-1184af595680", "comment": "Malware payload", "value": "91811f3bac27030772f4e79bfa790c9e09c183ab6ad08c71cbcc94204105b9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "98bdd3e7-66ae-4dba-8864-1140e012184c", "comment": "Malware payload", "value": "59635478d254abf3328e07dab1bd509aef9418ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "1226d8cf-05c2-4a9e-83f3-76fdd5e08ff1", "comment": "Malware payload", "value": "c8edb44d27e199ed7f8542a807aa281b07ac1174b040be222c52e2c03165040d0d01265253ad45b00a58c851cda1f6bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "47db5eb0-bf6e-4e19-b1a9-5b19773a6d00", "value": "T16B25F1161D873B88DBBE6FB8C163099437F0D8078292E72B7FDE11F49E92B84C915066", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "b083281d-271c-4370-8698-74850fd3bb53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "9389b62f-77d7-4c86-ac12-e5e966c2c478", "value": "12288:6QXwzkWh5YX8kBzdG7oe9mxHewPrQjekCmVALeuFWrcaWJlkQvddbY3kpBNa6:6g450jhwH7krKrVALNUSjkQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370442, "uuid": "df0c9cbe-b15b-428c-990c-251121749498", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370442, "uuid": "366e83e8-9999-47a8-8647-5548344d3840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "01b8da1d-85a0-479f-8fd3-a322dcebfd44", "value": "91811f3bac27030772f4e79bfa790c9e09c183ab6ad08c71cbcc94204105b9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575cb6ab-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RevStealer)", "timestamp": 1786372790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "dabb2d9a-7229-4c23-8f0f-ee7c0c52e112", "comment": "Malware payload (RevStealer)", "value": "69d45c7257a02f26d168b48c14612e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "7d70edd5-1fc0-4ecb-8732-92e0562f5add", "comment": "Malware payload (RevStealer)", "value": "91d44004bd98637f82c46fa2924f2f80c1574c9965bdbe618af5d5f4a2cf3424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "2827f25a-f511-4133-b6bc-3e77f860228a", "comment": "Malware payload (RevStealer)", "value": "ac59012f87362509ed86073237f17ff4709b81ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "402556ac-bc91-458d-87f9-b0ecfa32b50c", "comment": "Malware payload (RevStealer)", "value": "c0dd8cd0a6cccb9868d300f353711fa4abcde2066c936d5c615f147887c9301f1b23bc3cb38642047d40da9bf3e66c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "0f573854-3736-4d36-a470-727dc6ad0526", "value": "T1C3660827629BC178C63D973EC192CA549BF771788F3292E3F3C683559B424D56E3A220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "fd71990e-7dea-4ba6-bf25-02750647bd7f", "value": "84702c834326954655d1118866ba2cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "188cf2b9-0741-4c6c-8812-c50dcc2047d2", "value": "49152:0HKQyy9sC131rhTEzs/0vMSkYxkCbX+EzzLyCnwn9/:0HhuvzzDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372790, "uuid": "aaa9a68e-2c47-47bc-a0f6-f2f35211cb0a", "value": 6846904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372790, "uuid": "6870573c-20c2-46c0-98c3-d53d6f00189c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "24d77e70-1216-4366-b94c-e5d746aab77f", "value": "91d44004bd98637f82c46fa2924f2f80c1574c9965bdbe618af5d5f4a2cf3424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9733c652-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "3fe16aee-e119-4d18-8e22-4c08f8892468", "comment": "Malware payload", "value": "1d6f5ab5460155f38f4d0c7c2f6fd8f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "0bef6e47-5bad-49f0-9d97-7cff4ef2c304", "comment": "Malware payload", "value": "91e134147bc063254df25f675bdec05259eca85e7a9b80b0ce9b1973ccb26a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "48c736ba-cedd-4e37-ae11-7c09a7aed1f9", "comment": "Malware payload", "value": "bf4261960cf073a4a199b224297887dc0dd9a776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "8718b7bf-5d21-4ebf-a9ea-9372887918e5", "comment": "Malware payload", "value": "dc0888d281097a0a264347ca8785a9db663d31470845cc718bdda6e342b779a2311b89920c24ce88234c6caf5b016721", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397378, "uuid": "904eb1b0-1610-4758-ba9a-7989ba98caae", "value": "T106D30A06ED856EF7C01ECD70453DC24A15D65CAA92E9A22F71FCC98CBBBD3054AD7888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397378, "uuid": "dd2da6bf-8b5a-473a-afe5-9e37c27a45c3", "value": "1536:Ms0xOkk2k2TV9aKMw8HVmB8/JYwaBi8g4FnJGEavcF2kNm9bJlqnA9OUXLIEr:kD5FoS8HVm3wa5yCZNmdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397378, "uuid": "07ba6416-538c-4cc0-9450-bb6fcb3110b7", "value": 140068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397378, "uuid": "ebe8a6a6-f0a9-4874-89b1-6a94f7899159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397378, "uuid": "4b33f111-77f1-431c-a6d3-95af03ed7009", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d761670e-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786372575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "c72e401b-322e-4b85-9035-e7cffe95e6f1", "comment": "Malware payload (PhantomStealer)", "value": "0ce7712c14ca025f5295adf5260178b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "dc1c8903-494a-4ca4-894b-235be2e76917", "comment": "Malware payload (PhantomStealer)", "value": "92495a3e4c1e965e074186655ed5098e7020e44e0f1ebebc7442349c619ae5cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "c2bf5b20-bbe2-4b10-ad16-475371c2e211", "comment": "Malware payload (PhantomStealer)", "value": "19ecd24796e4321a52d200c2a1e0d01b7ce662e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "5c169105-b95e-46f7-8605-1254e63789a7", "comment": "Malware payload (PhantomStealer)", "value": "3390882d516533af288e3f70bffe37e9047167265c4464675741d7ff0c3bbf485ef0f0bdd942384eed93d844a328d432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "1d05dc66-80b3-4c00-99dc-29595b077ba4", "value": "T1A1E5BE55A3D865E9D426DA349714E232D2B27D234B76E08F0A8AF3061F779924F3FB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "78a73a95-af08-40bc-a055-1305005822e2", "value": "592f2a4e38c27b54ff57db9c30b12a37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "a1d3169a-737f-428d-90cc-2dc1b26459be", "value": "98304:7Z7iPsq1CjmWW1UaFNPToLOIqBpqsnHygzD57b+0nSFq8GTntboo/0xrgN3:7Z7o1CjmWW1UaFNPTPhqwygp7i0npdt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372575, "uuid": "135ecba6-7c9d-41c7-bd2b-03cd3cd1153e", "value": 3273728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372575, "uuid": "01f6763c-4ba8-44ed-a5b3-537870b58d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "40ad5452-99e3-4600-a1bd-98dfcfaf3e01", "value": "92495a3e4c1e965e074186655ed5098e7020e44e0f1ebebc7442349c619ae5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540d1ed5-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "7ea0dae2-472e-4bc2-8757-9627bc206241", "comment": "Malware payload (Formbook)", "value": "03f4819d233bd7f69a108c4a2a9f82ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "ef84f1f2-932c-423a-bae1-cb0f680f4753", "comment": "Malware payload (Formbook)", "value": "9283fe438700c0487565377258d4e4c22fc6b268005f5140000a2dd464cf4559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "d8b8d02d-25ec-44c8-b6da-ab94f4568a56", "comment": "Malware payload (Formbook)", "value": "c2636e197088aded0b178dcb7ffbbb77882ac067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "01043053-49bf-4474-bde3-8b02a942845a", "comment": "Malware payload (Formbook)", "value": "787c2bac3ada60354c2d2002774a7809922f47c1fd8d555ab869c19c1bbe5807ceb56b0ec30d61f9d7395b0e372f40e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "881a3ccc-27c5-496f-837b-efe5de724976", "value": "T19D35F1C4372AE709CD540A35D979EEF452AA1D68B041BAE39AEC7F5B75BE2006C0DF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "c10f58b6-60e8-464d-b14e-3990b147654a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "39dcc563-b150-4f36-80a4-3c48e44b7736", "value": "24576:A1BUFLa2JTh2YdWK6VfRhUOzFHVJ5auPdDlfkJuKh75Z:A4da2JV2XK6VztPtlAfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368489, "uuid": "c80a6732-2298-4bca-ba02-8cf792f94e26", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368489, "uuid": "84a78c52-9afa-4a87-9562-182eb08a97ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "edad96c6-1586-42a2-9552-6fa0c32743d1", "value": "9283fe438700c0487565377258d4e4c22fc6b268005f5140000a2dd464cf4559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9610373a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "1e862820-f800-44c9-849a-43b687281b47", "comment": "Malware payload (Formbook)", "value": "3e62c7c4fdd00831857b665202eba41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "acc33c8f-7a6d-492a-ab0a-9efab19af3cb", "comment": "Malware payload (Formbook)", "value": "92d433c1eb67b2d701fcf561b80e201706e0c6eb3ae7d7ca06ee3d268cb91908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "09fcdd78-dab0-495f-be11-b4bbc269f48f", "comment": "Malware payload (Formbook)", "value": "b9b6c4df23274c4074c2bb4078f525fcc14773cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "38fc6ec7-e9ec-4f72-92e3-7b1e1547c4a1", "comment": "Malware payload (Formbook)", "value": "14992d5caf458266c3051aef63992214e514ab9cc0b6a6d40513f98197470f2bdc4ff2f108fddf6b719a71771558b7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "f7a7efca-d708-4019-9c6b-bd58510230fe", "value": "T152451288334ADC02D4928FB04D70E7B405795E81A815E7579FFBBCABB97E3876C51282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "762bba6e-7b97-4dca-9fd6-17ab35a8c3d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "2955c9e2-b8bc-4b49-8697-3557e763d8cb", "value": "24576:8R6pFF/JhJELdARNPGFL2Q9/iVRPw8qnYdfahM/eZ:kifJoARRGV2D63y/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371177, "uuid": "2fdda608-589f-4f09-923c-8a9f72aa6685", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371177, "uuid": "a2bfda02-ca69-4126-8927-1ced2ca47685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "b7207e5f-1377-42fa-9c1a-a18455bb338e", "value": "92d433c1eb67b2d701fcf561b80e201706e0c6eb3ae7d7ca06ee3d268cb91908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eef7a79-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "e0ae96f8-283e-43b1-92ac-57adb914dc49", "comment": "Malware payload (Formbook)", "value": "e8a079354293e8e14560d13aec797f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "4f6175d4-8d9e-4b9e-b185-d63621ac04e6", "comment": "Malware payload (Formbook)", "value": "9359aaa225ca8ccbe7b5cc67145007036d171d2a119bd34689bdf3aa01f20970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "a8ca1df2-e0b7-4e6d-ba6e-b36c84b470aa", "comment": "Malware payload (Formbook)", "value": "cb3f0971c8a4eb867e8ba2f4e246032bb2356c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "cb8618a1-dbd3-44bf-8174-2dd620a7e7fa", "comment": "Malware payload (Formbook)", "value": "05eb02cc28c4a364be4c1966465f5f2b059bd65e112b9f4ee25f0074b989a56492b047838bf71fb49e2724d11d8ffd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "077661d5-32f0-45d4-b73d-6a186b794d7a", "value": "T1B0350219231ACD02C6935FB15E70E37905B85D98B811E2B39EF6BDD7F87E3866C12281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "ef24a2ff-6196-4359-bcbd-81ebb8c087c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "c8bd5772-83d6-4a29-b0ba-32b048edc09a", "value": "24576:lWejR6pFsRoSsD+WAnN8aXKDRfsXwYcJ/7wjc9LM8h5Yjcdqb6:lTtimRoSu+JzaNsXPcV7bLMOd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370977, "uuid": "e11649a8-4541-4156-bb06-b253de8f6aaf", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370977, "uuid": "fbcec7d2-ad37-4587-946f-7c520bee9c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "17fb7a8c-09ba-45b5-9c38-2faa9e7f1bfa", "value": "9359aaa225ca8ccbe7b5cc67145007036d171d2a119bd34689bdf3aa01f20970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08456ab-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "49b73232-9d51-40c5-931d-c7c5edc1acaf", "comment": "Malware payload (Formbook)", "value": "7acea89cd620fd29752239b1bd95e4c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "f6c2516b-a9c7-43f7-8a59-7ae5d579caf8", "comment": "Malware payload (Formbook)", "value": "949274b000a50d3c872f23806de4de694d8901129fe1393884c4adf35796600f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "4e9e9d3f-0316-463b-b9dc-6cd62080022a", "comment": "Malware payload (Formbook)", "value": "0b986719ebbfbc4b6e60b96a516ddd364e5367ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "ec6229f6-3bd2-4375-be12-5d5cdd388eac", "comment": "Malware payload (Formbook)", "value": "c4cef92e834f149ee029e3a0ef3ebd6ca7eebb3db50f497575421db9cfcbebab5fcb70b241701468114f590b49f7bbaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "e492a7ec-1775-4269-8597-665628bde1d5", "value": "T1ECB5D004BE4A1246DC02D4B7F8DF91A32752AF63C6F8A45FFA083F5E5451848D60B9FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "1ea8f5dc-9887-4ae9-8ef8-1d176fad42c2", "value": "b6363985b589e2443f1a337d0f18c65c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "f74ff811-7ebb-46d2-9492-6736e25ffcbd", "value": "24576:NHtIGsGfxQKvaYBXupd7ulZlbkGn07wwA:jIGpZZiYcd7uPWGnnwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372053, "uuid": "9fcfb775-313a-4ed8-ae95-ca6ba868be4c", "value": 2318848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372053, "uuid": "690345e7-00ba-4239-baad-b33dd1b895a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "8b82f91e-b3e3-435a-a58f-a27e59752a10", "value": "949274b000a50d3c872f23806de4de694d8901129fe1393884c4adf35796600f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c527f078-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "b869a62f-2fc6-4950-b15f-201fc705bb5c", "comment": "Malware payload (Formbook)", "value": "1d2a39143134d0e5ab88fa9cb2d5be82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "ab4fad9c-b92d-4fca-ad7d-b00bae38dc94", "comment": "Malware payload (Formbook)", "value": "94ae5d7c44f8072acdd2175088707215de59d62b03e9a3393312657788b2fdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "fac52f47-69a7-4f4c-b690-9340c3d1cdc0", "comment": "Malware payload (Formbook)", "value": "13e591515dc23a52a018deef8884050a10363e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "bb7ffcbd-53c2-4c85-8730-5189d29206b1", "comment": "Malware payload (Formbook)", "value": "8c42ce6a24e001b80e7d471b0af76eca36a04dcfd0de625fe3cdeb3fa5d5f8e585e84bc7f2956c1654bbda865b1c3382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "553d6a39-70d4-4e5a-a502-c10ad47d26b6", "value": "T1F035F19C7660B69FC857C9328A68DC70AA207CAA9307D30391D75DEFB91C997CE141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "41153e6e-3fa8-4a14-9b30-862b37596e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "4d6d436c-6f5f-40d2-ad48-5b8610105743", "value": "24576:urPj/Og3gaXECXvAyNMp+Zl9e5RSoI505HYMv+9VFm3:uPPQaDpNMYZjCQc5HX+9VFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372115, "uuid": "d1801366-208e-4336-b8b1-1ac7cf8a7294", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372115, "uuid": "6c87988d-fbf6-467d-824c-6c6da2889b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "12a27481-d385-4d0c-a34d-a065bc506e63", "value": "94ae5d7c44f8072acdd2175088707215de59d62b03e9a3393312657788b2fdf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd77ffb7-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "9425b7c0-caf3-4f2b-8c83-8fd80f6789be", "comment": "Malware payload (Mirai)", "value": "37ca7c8d14be840ab6d88c07c79cf445", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "09b37365-33ed-44ce-aa53-9d81f582883c", "comment": "Malware payload (Mirai)", "value": "94ca187d2680779089c15de5cb075c8368a033914ed3d960b2cd7b82e7553fbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "91b0afe0-6c0f-4e99-a7a8-1c4bc1755679", "comment": "Malware payload (Mirai)", "value": "a0461ee395007f457a6a8996f5a96d8fd7029075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "339f4370-d54c-40f2-bc39-81343d07cc4a", "comment": "Malware payload (Mirai)", "value": "4fa34529b05ad6991dd92daedef3e4cdb64c1f781f1d8e59fd4beefce1c49b18f326e552357d24e57705efbf9400542a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347191, "uuid": "9f80e866-bcf8-4a47-8511-08d5b0be91cd", "value": "T1A8C4BE67F5261E43C8E3953E2567C2B45327E60A27919306A70EF5B83DE63398F293C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347191, "uuid": "55fcceb7-4384-4f6d-bb36-cddf14d95cc3", "value": "12288:inzxoZ+93Gdx32umLhhwMwtHnb6arR6zJ08pgWijUhRCdTf6/ozxehED9zB:GweqxG+MaHb6pi1f6/oz4hED9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347191, "uuid": "7c7a432d-a7ef-4eb5-bdbf-b35d78d830dc", "value": 583224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347191, "uuid": "152719e7-f990-4b4b-b2e9-ac3d49d0e976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347191, "uuid": "03f6a4cb-221d-4900-9739-e45cab3b6ac6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd521af-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "362018b6-a5a3-4e7e-9aeb-bb769fc71501", "comment": "Malware payload (Mirai)", "value": "b67831c7661eb598c8100012585e409b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "a022fa76-c0b0-47d2-9979-9eff8098d579", "comment": "Malware payload (Mirai)", "value": "954dd815b49eafe68cf6f493ca1cd9a409a6f1af48c25084c844a24f06ffa38a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "8eb96f7f-353e-4c45-8cf8-e9d0d5333689", "comment": "Malware payload (Mirai)", "value": "c1748442e3573089b7c8638e60996636084f75ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "518f2432-ff1c-4680-a1dd-db25b31a3a44", "comment": "Malware payload (Mirai)", "value": "f3e3f5bea6cd79976b0e4ebe7ceff79cc88fc144a3ee86695d25c3fd91aceadd2ae9b7cd6b161d1ce4c3298481c5caa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347188, "uuid": "31d285ac-c091-4d0f-ac8f-c01ead8ce240", "value": "T13D83081ABD41AF15D4C526BAFF1E524A33531BB8E3EE7202DE146B2527CA91F4F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347188, "uuid": "4887d587-1db8-44fc-a24f-239edfcba86d", "value": "1536:fqnOlox/XLmikBwoGwfC9itxxsmrYSsEk2HVVo0rbdlhti51VGIn:floRiVG9YsmrbsEk2HVVT5K1VGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347188, "uuid": "508b73c6-2030-40b3-8cda-24501d248d86", "value": 88260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347188, "uuid": "41e1b284-cd4f-44b9-a586-57b5b100bd46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347188, "uuid": "8cf37d96-679c-4c28-8ee5-4bb21ddf8b1e", "value": "1htR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203fdf0e-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "85fc9b48-63f1-4313-a0a3-5dff6e5bd36e", "comment": "Malware payload (Mirai)", "value": "03c0a94926b1e3a5eb4ef01e2e3e3c79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "5f67149d-8b09-41ad-9d68-967f829f2847", "comment": "Malware payload (Mirai)", "value": "9615213e9f9922391e28f1cb9db166094c75608fab45cd4cd15cc767a2d69646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "04c21104-f2d6-40ff-bed3-6a9416abe599", "comment": "Malware payload (Mirai)", "value": "33c683d4dd3b34a06a4f1984e4cca11f52a7fe7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "3bd55bd6-1251-4cab-b0f9-0f7914fe1201", "comment": "Malware payload (Mirai)", "value": "15035117f41354c4414893f0b52e07c64a5d5230121de86c6a21f79876e4e0dc05513652236e2a71c7dde0e52aaf6c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340055, "uuid": "2542ee89-3d1d-4051-9b44-5095d2de3631", "value": "T16684FC8CB5F2E2CAD1D4E6B5B319784937530736B1D77146A50EEA3323EF19809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340055, "uuid": "34d65cbd-de34-4549-873b-ff81d06c0874", "value": "6144:qLa9ja9Pa9aaKdGrhWK3eDRs75844u5TuTo/SkCpiA0eh:qLa9ja9Pa9aacG2DC7f4kO4Cp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340055, "uuid": "dbe74af6-e895-4b04-b668-b4b4de7c070e", "value": 376004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340055, "uuid": "e704e83c-523c-4538-b6c5-c1c0e7c1a9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340055, "uuid": "77cbb903-9ca7-499a-8547-f8e88698bfd7", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0ee63e-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786372371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "f12d07a4-b00e-4e0a-8025-1dea8b83a47b", "comment": "Malware payload (Mirai)", "value": "0227fde0bb0c05809f84e34bb6c7b8e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "bbadfc05-37d3-4b77-86ff-acf9c3b37279", "comment": "Malware payload (Mirai)", "value": "963d986f444f3a811ab89a50dd7f642621d709fc5d374f6d34445ee730c5924a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "f90dac1b-fa7b-4b93-918d-49cd9b977244", "comment": "Malware payload (Mirai)", "value": "cee3a366b6c4edfaada8e8015fb6d9c871281457", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "62c7f876-f4fc-4fb9-bd26-c19fc0858ac6", "comment": "Malware payload (Mirai)", "value": "8e9a73fda799ba02eff488ba8c4f5f28b95d412500f79541aab5c880304c46b2c5a96cedb369101c50bd2775c0d29ebb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372371, "uuid": "ea96c758-dcdb-482f-987e-c8ca8b28ad4d", "value": "T12DA1E48A3070973CA46EDE6C3DE54A58688985E237B13F395EB008737C89970B749F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372371, "uuid": "ee12feb0-deaf-41ff-9a5c-d389004afd18", "value": "96:jl98rvBibLxD6xIAJ3foxP2j1y66xn/4OQTd/SnB0L6Tm/tiVXZIpF94hx8fbctt:jl98rvBibLxD6qAJ3foxP2j1y66xn/4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372371, "uuid": "79f6fadb-b370-4762-a92e-0546902a10fa", "value": 4725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372371, "uuid": "9f160861-aa78-44aa-8061-7196d23615cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372371, "uuid": "0e262fbd-bc65-4281-85bd-289de53320ea", "value": "tvt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a27ceb-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "e58c3869-14c0-4020-bcdc-ff298c5a1475", "comment": "Malware payload (AsyncRAT)", "value": "feca54b5cb43f2855ddc27bd8ec8a198", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "f1361944-592c-4658-b505-c2edfdeee1a1", "comment": "Malware payload (AsyncRAT)", "value": "9666e6c9474059b23b4c55a894f2a5768b0a37fee47523c281e07b7df4f2b1c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "8a40b8c6-a98d-4914-bd07-07b1c1c9854b", "comment": "Malware payload (AsyncRAT)", "value": "32608a9b7676e3678f219a9ef2930512c7b275c3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "c582bc38-eb32-41b5-8f6d-fa6f37817491", "comment": "Malware payload (AsyncRAT)", "value": "cb9c7eeb323cdc12890295d902ba1a663407a679bb40561ffa6534196647da8006e3e96a670274b69d251cb6485de85e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "0cb9f6db-843d-47be-9a48-824db3ed8678", "value": "T133F412683BA2CF02E5765BF91273E23147B92CDA5A30C10A5FDA6DDF7553B044821763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "20aaca72-a991-4df0-a70d-5b6ce994161c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "6db3ae96-01df-4fe0-b89f-38eaff54107c", "value": "12288:m03CpLaqpsXRhpAzfA2eC2EKoj/UwTyM2x3XQNrvOLMt+ZNZxfKHOccj:3Sp/+GzfmCIbweMWnyTOLYIZ5YOccj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373882, "uuid": "009b49bc-aab9-4c7c-a357-9e667dc4fa5e", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373882, "uuid": "a4e2941d-b375-457f-9dbd-4c9f7728dd88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "284f687d-e082-4ca7-9431-57e126d2e0f4", "value": "9666e6c9474059b23b4c55a894f2a5768b0a37fee47523c281e07b7df4f2b1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d9a5e6-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "c9a11381-c58a-4ca1-9555-caeba19e2fe2", "comment": "Malware payload (Formbook)", "value": "42f6de0963bae9859d133f52466bbd2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "40967786-58c5-4c99-b6ca-bec920f19df3", "comment": "Malware payload (Formbook)", "value": "96840e2fa8927c1f709d170e0eef870ce4ccdf67b312a1954049583013a0e975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "c7957af4-dc3b-499c-a8d2-e1612f7edfa5", "comment": "Malware payload (Formbook)", "value": "04aa2084f27f0ffa136b4342ba861748650d5a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "6323a941-de2c-4c61-a0c1-8bd65dc25a2e", "comment": "Malware payload (Formbook)", "value": "e246427909e23ce8a16c1a006fd00b82244e6781cb6e3d8a9de84b586b8d18086ed9273131fe71cf82f1821680eecd73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "3765b257-4b0b-487e-bd73-a8fa27b2b5f3", "value": "T1F92512B06689D921D1A6437085A2D3F900B6BD0DE020C76BCBFCBCDB3B72B86745575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "1b25c1f0-fae6-4afe-8b02-2ce8b2774dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "33d62870-f468-49b4-bea5-36bf32cae1fd", "value": "24576:By5Q4ZE5P+1Lj3eYwRoeTwz36MpW/YTIAa7C:BqQ4Euf3eYw2kwz3XWQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368708, "uuid": "a3900aaa-b064-4c00-b58e-383e2cde61a9", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368708, "uuid": "4b246ab1-9e7d-4f80-a69f-f9a95b6ab378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "732e91a9-629f-489a-9355-d3129dcd239d", "value": "96840e2fa8927c1f709d170e0eef870ce4ccdf67b312a1954049583013a0e975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465b0277-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "8e290d50-5f5c-4955-9836-baf0023b9836", "comment": "Malware payload (AgentTesla)", "value": "3d1bb58c18b5476fd0174053e1d01c54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "4c5aae4e-75fa-435f-80e8-1819c4df5ee3", "comment": "Malware payload (AgentTesla)", "value": "96bc0795b6b630c8079d53feb88a0331e89b27747fcf7ed464c672b36d8e1354", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "7fa340c5-32b0-4163-b5c0-479cfe9c9b3e", "comment": "Malware payload (AgentTesla)", "value": "d74d3433af254e0432d1f8ef4e3012a67ae25ade", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "33705f2f-10f0-469d-9583-e805ddb56277", "comment": "Malware payload (AgentTesla)", "value": "acb89e8de850d0cdd86368dcf4d15f8eccf3e1b4c0ce4806b662924ade5107e768390a2c58c3d446797d2e5439823d37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "c429755f-f4e3-4f78-baf6-b5521f0a3e10", "value": "T1162512086A06EA02C9A4C3B84A72F2B9277D5DEDE410E2076FDDADE7B575F244C44393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "aebbcd9c-3ae1-4694-931a-3997041826f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "d886c7d5-8e4e-434c-b817-3a535aa23b11", "value": "24576:QpILJFdAIWJdBlhIM1lVmIssh/rIaVeA9s:QeLJAIWJd5b1lmsNrIaMUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374049, "uuid": "24f1c78f-3cca-4692-b719-007df6bac86c", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374049, "uuid": "6f0546ca-b179-485d-808a-c0f92372dd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "6bbb7566-6333-4595-8100-f1ae14ba8b8e", "value": "96bc0795b6b630c8079d53feb88a0331e89b27747fcf7ed464c672b36d8e1354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f363af43-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786373910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "dfcc8591-aa46-40c8-8ca7-a74f2254cbcc", "comment": "Malware payload (XWorm)", "value": "e901ead227e8cdd8d274dad6a29e3f0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "17cb25ff-8590-402a-bc6d-0bfcc474954e", "comment": "Malware payload (XWorm)", "value": "9719021478f61f07d57a297ed9638d63afdeeccf3cd4771f429f8af8c353c634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "7e1debd2-e6c6-470b-ad36-9f61a64a873e", "comment": "Malware payload (XWorm)", "value": "901300032754f5e09e107f1254d58a6c52d50df8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "55b38d3d-68a2-4a95-bd64-ad963f46ab22", "comment": "Malware payload (XWorm)", "value": "55d53edcd7fa248da8374dc58de072ba37130f46ffe009b358528e97d8e4d8ee9f877730466e56bb5a101662b0200682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "8f748c6d-3e9a-46c3-a273-2ce87b1bfe10", "value": "T14F345F9EAE0106F7D70CF83580F3332D537ECE7A3A965F5DE89E3EA566718884949810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "65d4188a-022a-4a04-a0e7-e0abecd2348a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "84d3c21c-bfd8-4148-8cab-86b252967d64", "value": "3072:5LhjyuO/ooM3joJizpbOw7M/EtYmS4g+Ehfr:Nh+vLijowdbPW4g+Ehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373910, "uuid": "81def0b0-e73b-45cf-8f4f-3ea1fc50f378", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373910, "uuid": "a49869b0-e263-400f-ae52-81f019ab43a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "ca27196b-2ca6-4918-b0e7-679cbebb57d8", "value": "9719021478f61f07d57a297ed9638d63afdeeccf3cd4771f429f8af8c353c634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b851ee-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "16d1b546-1cd9-4a97-a756-0b1a81d16a07", "comment": "Malware payload (Formbook)", "value": "b2abf4c875410b084de90b19506088a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "1a8b6aa1-8b84-4dac-841a-452fcc55c443", "comment": "Malware payload (Formbook)", "value": "976529425f33163b3ce6c6edefb343aa3751472a2232d7d2cc72dcff933c46df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "96525472-ef00-43e1-a4fe-04a8de911b51", "comment": "Malware payload (Formbook)", "value": "198cd8b2f7aaaa8bd3f53213cc39ea6b2d5f7bb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "328afac4-a0df-448d-8ac6-a760f3358bee", "comment": "Malware payload (Formbook)", "value": "451f1e95a4917349c83539c798f01c1789802d5b9a29021e8ecca96242127ff281ddabf7e23c1474c500bde5fc6f8100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "c7d493aa-9710-48be-a280-462964be5c12", "value": "T1C9351224265DE803D5960FB41D72D2B057782F8CAA22D303DFDDBD9FBABB6A12844345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "72c396a9-8316-429b-86c1-3b160561ef5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "abba15e1-7035-46d2-89cc-a96cf25d0da3", "value": "24576:ka6UwlR58YA5HbOhTe7dAfSI5WxBYzGqifHakQD0:ka69lR58YAtOE5I5tSqEU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369004, "uuid": "25ac571b-a667-4531-b3bd-a0a9a78b96f4", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369004, "uuid": "495f5d66-ce4c-44d9-a887-30269926e0af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "f933b041-0d8b-4508-9320-a4e7a7edadc8", "value": "976529425f33163b3ce6c6edefb343aa3751472a2232d7d2cc72dcff933c46df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33700fa3-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "58e11e25-c2a3-4a99-a015-59e3f2b7d33a", "comment": "Malware payload (Mirai)", "value": "dff17bf4f87aad1f1fde602d1bddd1a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "65a2c5cc-2c3c-450b-be24-23d165e0971e", "comment": "Malware payload (Mirai)", "value": "98196b4050ff4ef422082b82e54b63570955e0fdb2fcb8ec5a0783d6d97e2264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "75aefaa7-25e1-41e9-a688-fab8844ff462", "comment": "Malware payload (Mirai)", "value": "d15ceee338fd9f91fef30d48499fc3eb984c5e01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "46867ba2-fb53-453e-bba0-85fd9460f0f5", "comment": "Malware payload (Mirai)", "value": "23a86b8ce4f6228abb8e11981988b43504778e09bf3470720826dc2fdcb188435b13ddebf7c33c52a5765120918834c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328921, "uuid": "72b2518e-d5b0-4d5a-9120-96e1e70a2d36", "value": "T10883D506EF550FFBDC6FDD3706A9070225CC665B22A93B3A3534D928B55B24B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328921, "uuid": "b44f35a7-1292-40e1-89b1-93f648a57444", "value": "1536:D3qYhpgNaGTdS3hYY4Z20uc8c3/aZ0U214Vl93yrY3Y82Iz0Q:D39hpgvTdSJTc8ia/XGb82q0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328921, "uuid": "10f95c64-2d3e-48b5-ad65-42faffbd1914", "value": 85300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328921, "uuid": "309ad1b3-db48-4088-9ac3-7971e814e764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328921, "uuid": "caa9e480-e977-4d96-b0e5-41a66469cfa7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf4039d-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "43ff0769-003a-4f06-a701-a1b6762a6a6d", "comment": "Malware payload (Formbook)", "value": "f086b53c7a3836694a8a3161f630657f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "1d4f811a-f177-4561-908a-19e8587a43e6", "comment": "Malware payload (Formbook)", "value": "983138aaea5f4123933dc6f0ca33e35e9a087c5e8cc20e6bd118a7cd56981f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "6bd74243-6d72-40ef-9e9d-a601a3977c2a", "comment": "Malware payload (Formbook)", "value": "bce939be25a9a06b3009786c83d8a9a731228212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "519b30e0-8ecd-43f8-9741-39cb8259bd3c", "comment": "Malware payload (Formbook)", "value": "83fc2c5c758a5c1034e0da5ed9a396ba49ce18bdeb9c144eba3354781b1db1efbe6ae588d0566edea07daeaf669f81a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "2bca2cc5-7aed-4ee7-ab2d-5e6f6c400467", "value": "T117350154232ADA01E1D687F6B8A0D37433B41DCF78E2C3964FE56FEB792D3842954292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "50e74c1a-b665-4aff-abc8-6e9b2966086a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "7fff6adf-e263-4d93-996e-6bf6e2cd62a5", "value": "24576:aip50yzA4GJVEQvpIitp1Po5Jf0MX4aJcuhl:rpzAPJ1vq0TPo7FROuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373037, "uuid": "85cfd2f3-98fb-4c96-ab8d-996b0206efad", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373037, "uuid": "830b9a83-96af-45aa-bc2b-ca51adaa10f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "8df4b5b0-0d64-404a-a781-e6c15b919035", "value": "983138aaea5f4123933dc6f0ca33e35e9a087c5e8cc20e6bd118a7cd56981f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2308a43c-945f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786327175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "afffcdc8-9242-4161-a0d4-3ddf2ed4a824", "comment": "Malware payload (Mirai)", "value": "6df0f866bfc65e4701dc50a3888c4ca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "af9a873d-5cb8-45f2-bd20-cb7ca1a4f0a4", "comment": "Malware payload (Mirai)", "value": "98497bc74a1bb5ff9750cbeb785bc245ccec38d570b3ccbdc88861dee6b2a498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "b4672fe3-e9fa-4676-9a03-1894b0c28650", "comment": "Malware payload (Mirai)", "value": "8024164bf7336e2b2ae0996445eb45eac3de2fc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "d9ddba03-60bb-4943-b9c4-9e28eda0e1ef", "comment": "Malware payload (Mirai)", "value": "09a930b1a11f9059b3e53f3eb8f28f230492721656b29f19491c7f18730e4ae21e6513ce8d8779b93ea6884105f0b371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327175, "uuid": "1b588e8b-bbc8-428b-94d0-8fbfaa4e181e", "value": "T1FEF2E17BEDC9A269E750183CE838C203B321186484877F703195CA6039C6B67FB796E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327175, "uuid": "075c4afe-952a-4673-9320-d486a07ed101", "value": "768:zDcN8in1nNDvuT7k52wmyVeSnQKLOKcfOHaCuk1BwUq3UI2VY:z4+y1nNDo4sw8KLOKqCuk1yCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327175, "uuid": "52d5ab66-a8bd-4288-9620-423a01b0bef3", "value": 36608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327175, "uuid": "67a5b4e7-6aff-4124-ac0e-d98e402f4f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327175, "uuid": "3f99f25b-e47f-476d-ab0a-14e4227befdb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2776a2-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786372667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "71a4feda-1c24-444e-be8d-7fe7e296fb99", "comment": "Malware payload (GuLoader)", "value": "32c3deb1393d65c39052b862b2525598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "825f7629-b293-4d43-8bf4-2c75c30b1f4c", "comment": "Malware payload (GuLoader)", "value": "9856e1947303d24a288bfda2c0523a9d111cda99ca7a3968d45a0b74971330ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "f94f66e1-4835-48cc-bfc8-4bced387b58f", "comment": "Malware payload (GuLoader)", "value": "2116dfdf180edf7ddd2a1f1d50f13e6735e1ccb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "b9854189-7bf3-492c-b556-debf9a2ac4bd", "comment": "Malware payload (GuLoader)", "value": "122a0714e6b82311dfc03d2f6dfaecf3fecfd5147ee0fe7c10abf83428cca32c47343399c20cd3a5672e8783ee37812a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "2f535e71-f43e-4ad7-afd6-8b08e7f03756", "value": "T16D6412553686C427C0619B70CC7A89F64518DEF6CA27C30BBB19BFA97A701D28F0D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "865c0175-ea52-488e-9097-56772882bc59", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "fdc02635-6cdc-431b-949b-797380809bd5", "value": "6144:yB+pgU8O2WlqNhtWMZg2q0RpeoRlffJ6Zd1tW0Esu42BuPb4J7+exCAaFRTm:ygUOxlCnW8g2BRpe6f/0Es92Ib9q8LTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372667, "uuid": "09425943-d6ac-49d8-a84c-f048c9b8a9d6", "value": 311832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372667, "uuid": "51a3377e-6d48-4461-922e-df177bbfb1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "01ef956a-b4ed-4d0d-85eb-e7f2bfc94483", "value": "9856e1947303d24a288bfda2c0523a9d111cda99ca7a3968d45a0b74971330ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c668cb4-9482-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786342169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "325668b7-afa6-462c-ae08-cb4d823254b2", "comment": "Malware payload (Mirai)", "value": "3316f3e502d4f481cc501f3d104920dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "624e7e7d-fb7a-4622-bdc5-bd2ef59723d2", "comment": "Malware payload (Mirai)", "value": "985b25cec977ee124c1c37a61b11fd1aa1a9684c86e27d253d39e529152b99df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "f6507a76-d52e-4896-9b1b-b01d8b78a85c", "comment": "Malware payload (Mirai)", "value": "ebb4ff35faf7a12fc358823fe66f1ec41c65bd67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "6db40b1c-f581-4747-9275-4a79132bbbe5", "comment": "Malware payload (Mirai)", "value": "c0639ce1819e890cfe590b9b83d2cfb8092ca2933f7cf16bbed1f56ec8f357ae8e5216324a0893035fe2fd7a14c2460c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342169, "uuid": "08df932f-35ab-4a19-a229-929ad734fdd2", "value": "T1ADA48D44B54F7D52D3D7E2BCEE0DCAA1B20B79A8C1A360B27E43434CC1669E1CAF5961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342169, "uuid": "17599f83-e056-4c23-ab8c-a41756e5727b", "value": "6144:P54jSaOrB96yy8i7QqQxqnCUGv77EBIPeOz+E6MRafB+ASdSkq:BKStlYQ4nC977jWIwfBR+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786342169, "uuid": "6f9f56bc-bb78-4e4d-8d07-04c2e6606317", "value": 480432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786342169, "uuid": "ed404b34-8fe8-45e4-a9fa-660f39fcb642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342169, "uuid": "3d9a810c-e373-4563-bb2c-464ce4954f9d", "value": "985b25cec977ee124c1c37a61b11fd1aa1a9684c86e27d253d39e529152b99df.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32cc50a-947f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786341188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "3ef32461-6dc4-44d3-932a-9c300448f591", "comment": "Malware payload (ConnectWise)", "value": "e10c908084a0f5c95b1d3eae437d4db9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "99c4f4ea-5c03-4657-a910-c8ec6ab763ec", "comment": "Malware payload (ConnectWise)", "value": "989534e8cc8d4a18a9d1e2bf0d3c6492a66a7cc79cdd0c600b5f427d980cd23f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "bce38d09-52af-4b20-84b8-dfc829889351", "comment": "Malware payload (ConnectWise)", "value": "253aeb12fab4fb1df322f451f2ecf87c2b9a7529", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "557bffeb-2ab5-458f-8020-32e026f9c755", "comment": "Malware payload (ConnectWise)", "value": "f189eadab4114e12bfc97b19e53a95d4fe36adc0d0bcb041602a8e92161bc4ed6edc7c21ecdc9040fcc67b11f9bcac04", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "18c03225-c517-44d2-926e-ed9bf654e0e1", "value": "T1DBD61211B3D694BAD4BB0638D87A52655235BC148762C3BF6790BD6E2D32BC09E32373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "de6a00f1-f777-444f-bc48-5e69b216da7c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "c20a42bb-144e-4284-9f1f-645369425357", "value": "196608:1c8fefPSoHQjDSOgtEPDDoHQjDSOgtSDoHQjDSOgtkDoHQjDSOgt6:6QowXS2/owXSUowXSWowXSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786341188, "uuid": "a1119051-3a57-4330-83d4-c9e0d2835eed", "value": 12803128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786341188, "uuid": "59c0a7f0-deec-411e-879b-424d9b9681c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "e1c49eeb-5f72-4cd4-b4cb-c8ce46a6c15c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7098cfad-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786374120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "22fb4274-db2c-4748-b387-ef8350520cf5", "comment": "Malware payload (GuLoader)", "value": "cf733e17734a1807c81291ce184e220c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "ac3df2d0-8b68-4005-a347-d1526fdfe500", "comment": "Malware payload (GuLoader)", "value": "98d7f98e3a4aeeb62a91d5c90292d1ff10aa46241a72968b686b77ab83798376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "ea657899-d8b1-405f-a46e-032ff588360b", "comment": "Malware payload (GuLoader)", "value": "56c81f546d1d51396a2ccd47f53439f8111ed8ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "1eeaf61e-c338-4ad4-a4b8-528e5b0b5b47", "comment": "Malware payload (GuLoader)", "value": "84048e43b27f390d8f18f169da2510b4820b8b0805d3fc47211d1577c886c700966eabe87967d32682d458f8406a7184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "c7ee009b-0b30-41ea-882c-d03aaf331589", "value": "T124848B67FA63C4FBCE7813F2B5C3E5BB1DFD6456AC94909967E29A937000E321A0D124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "9e8522bf-7f12-4412-9366-f4b2c5c6d9a9", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "d1eb04f1-862a-41ad-be92-3894c2555c1c", "value": "6144:Yz20GHu6JDLDQSP4v95xtTyxYj1K4Vw8qxI8t5AykX/AEKsR/UHe3X:fDHVPWtl44VyxXTAykYENFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374120, "uuid": "1834d252-6f79-42ef-a4c7-6c6d3ad42fdf", "value": 377904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374120, "uuid": "f0798f88-a284-4ce1-80f6-86430de332a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "14d33852-81c7-4323-b73b-7f59f5facefc", "value": "98d7f98e3a4aeeb62a91d5c90292d1ff10aa46241a72968b686b77ab83798376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2494a16e-94da-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786380006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "b07ec64d-29e3-4b95-9073-61536822c5c8", "comment": "Malware payload (NanoCore)", "value": "0c7777f8a20db42cfa577f16e8eab797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "70d62fe4-8104-41ec-b2ed-070d0e05c425", "comment": "Malware payload (NanoCore)", "value": "98df0a98985b1d5cfc8278f8eb65adab2e5c5a512cbc02dac39abc5f265a7344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "db891f3a-6fa4-43be-8ee5-f1e0073f011d", "comment": "Malware payload (NanoCore)", "value": "67a72320caede2dd6055d9f48c9348770480a5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "c250ba0c-ae45-4b41-9bfc-6ae46f0bafc9", "comment": "Malware payload (NanoCore)", "value": "284c768802cdbad64dcb7702f35f71cbb9b3a84964daefddb85a52b1b45b932fc8f51e020b73a1b59becb230c456bfc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "3e28bfdf-a9e4-4a92-8673-d3bccff1981c", "value": "T18B14CF567BA84A3FE2DE857D601252139778C2E39CC3F3DE18D865B69B263E00A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "dd9ba189-0b7f-4cf1-927c-8b67b08cf62e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "93b8a069-b060-4f0d-a2e8-4508e9f0615d", "value": "6144:wLV6Bta6dtJmakIM5CjaSdHlHMLHLpnN5g:wLV6BtpmkV3FmHLpnN5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786380006, "uuid": "417af0a7-3f3c-4deb-b45c-c33761037b19", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786380006, "uuid": "5896945e-7497-41b7-8ed1-9f2e5f3927f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "2841c50a-f813-4603-849b-8dfd318ffde3", "value": "0c7777f8a20db42cfa577f16e8eab797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be94e72e-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "0fcfc7b9-6a3b-45b3-b022-8169554e971e", "comment": "Malware payload (Mirai)", "value": "46b7100dd69f46ee3c6cea7ea0234408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "33b32aa8-9c69-49b1-bb4f-9077df5be9c4", "comment": "Malware payload (Mirai)", "value": "99c11447a1238a6391b69d113124034bf106cf78b1751dfacaf7181ce803f88e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "2d025dcc-067f-416f-8dbc-677914105998", "comment": "Malware payload (Mirai)", "value": "56bf631a81c3699b8e816f53589a27d20cb26c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "1ccad406-fe90-4a82-b5a6-0cb2972d129b", "comment": "Malware payload (Mirai)", "value": "7918dd5f71db67ae24e36196e30d080bb92a93f85295dab9ba60c8290e4c26938afdfdb2ff7636c247007278e8163255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347193, "uuid": "4f75c9cd-27e4-42a9-a96c-d67ff54d761b", "value": "T122F44A56F8808F62C5D1267AF65F42A8731347B9C3EB720699188B343BD792F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347193, "uuid": "402570e7-3266-409c-8902-b68362952e7a", "value": "12288:mA+8gcxYhR4TYwVpuX+coDRSFgIvEDVMpxXi0xPO18pCCCjobvvrwT6y5zxZPJhm:mADgcxYDQVpzFDgFgIvmV8xBCEAT6y5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347193, "uuid": "1e586cbc-caa1-4f9a-af41-3c2ca3444b20", "value": 751400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347193, "uuid": "ea9a01b3-ad11-4ff9-a629-ad3622bbf073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347193, "uuid": "1c55d75c-8036-4d22-8112-c173892f4785", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef320620-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "4a7e0bf3-faa1-40e2-a4c6-2d8f6fdd3f44", "comment": "Malware payload (PureLogsStealer)", "value": "a97a27e4b95e0a9d06a27a71d01d65b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "82d93992-807f-4750-a909-2e3d436822f5", "comment": "Malware payload (PureLogsStealer)", "value": "9aaa59b37a55df8b5b87c64a828067baa6c0e8ace9d5a46412acd31c5d20ad85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "2159a626-37ce-42c6-b687-90e3389cc5f1", "comment": "Malware payload (PureLogsStealer)", "value": "403930ebd8b292721a7ac4af6148794220596639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "dd074d41-4f82-4608-894f-a6ade171c2e8", "comment": "Malware payload (PureLogsStealer)", "value": "25c4f15869f19f2eb3cad536d03c65578f2b77a84e2be17fb58c348cba55277b9ed8d52d705c2cd3b393c3836eaa7f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "7cd2ff6c-1004-41b4-af80-211904decb9a", "value": "T16D75239A9AB5D302E8BD2BF106A4E63013FE6C0DA212D2575FE52DCFBA17B101C05797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "d0406e6b-a16d-46c4-87d4-cafaef29c5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "1297407d-7e77-4801-bb4c-35d4529b0401", "value": "49152:MW1NOhpnYTobKwwbwc5JFaMoXGvLxJ+D4R2:JOpnYTxKNXGTDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373903, "uuid": "c7895e57-b20d-40b5-87de-36a74d4dfd1e", "value": 1602560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373903, "uuid": "c278edaf-866c-4fea-a52b-03eae262e085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "f9122bec-2415-4506-af14-6ecf2dc7ec45", "value": "9aaa59b37a55df8b5b87c64a828067baa6c0e8ace9d5a46412acd31c5d20ad85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b8756e-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "70368491-9e45-4fa7-b2ed-14880b8827c4", "comment": "Malware payload", "value": "1109ae36c84ffea5a24c444e745aa0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "3edfaff4-908a-4d42-81d1-c5d0470677e9", "comment": "Malware payload", "value": "9ac880622694166a43903121cb536c14018e6e88c4c53d2e44469d63642dcb95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "529cafe8-e63d-4c6b-8b31-b9a524240566", "comment": "Malware payload", "value": "8d2d3dd9134548767125a27d0921e72d832eaa38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "e662c9a7-8cbb-496c-b7c9-84a52813b996", "comment": "Malware payload", "value": "a078dd503b7205b2992ee2b3668026aa4950b673beb78f4b6d4fa2c00dc65cd1cab72b2bf09f9fcf820c6377b5c9ce6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "d40962e7-e1f1-410f-96dc-3453d7003062", "value": "T183363817AE9158FAD099E331C8B74115BA74B80D8B3123D32EA1BEB82F327D16E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "53c40aac-820f-4bed-acf7-8a11c83b3c21", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "83d947e2-54df-4764-8df2-50784a274260", "value": "49152:r0D1TyiL03tCxMYXysc5LOcNKKiAw3KFcWGiAFJDUde+9aEp7TuMESPLfjrZGHcG:r6lUGsqAw3KFcvik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349616, "uuid": "26114a09-9dbc-4377-a52e-7c8d1cda08f1", "value": 5292904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349616, "uuid": "6dcef819-f8f5-4a87-a24e-c751a67e902e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "711cdb53-306d-4f78-9e43-daa0cb13b3c0", "value": "1109ae36c84ffea5a24c444e745aa0cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513bfb1e-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786346150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "59db05d9-166f-471c-a18c-d6879a0839bc", "comment": "Malware payload (Formbook)", "value": "ba347ca5a361abf2e7c24e505f0c8b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "cead4493-46cc-400d-a087-27a7b66c7925", "comment": "Malware payload (Formbook)", "value": "9ad3e2c70d39d128d94bf6988c2dc94a5fa63d125091c09d88143b04583e301d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "0306a9d8-d5ef-4db4-aa0e-ab18844fcfef", "comment": "Malware payload (Formbook)", "value": "b11b30710c5520fae58880d63fcbaaccdf3c6985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "cdc67db4-9add-483e-863b-a6c77692779b", "comment": "Malware payload (Formbook)", "value": "e8415e2bb9c6de6b6c6e2d7c99a0d383c6105d5d9f9a989097818e52ec24853e45a8e564a92bb5242d1f5e862a5df600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "9f49f651-9135-4675-bd61-bad754d02e4e", "value": "T1DA35014023ADEE15D0A38FF419B0E77407746D48B920E20A9FEA7DDB797A78568443E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "c3c45183-c62d-4825-97fa-9d5caa13ff68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "4e3a543b-300f-4ae2-b07c-7e479151aba8", "value": "24576:+HWpGWVIh8oYObXjrfkrlS8wQ/QXpfNsvSg:rxIjXPfAShQ/QXNmvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346150, "uuid": "a1219a75-475d-4368-8aa7-ee5425cd3917", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346150, "uuid": "957e0133-fa09-4959-9103-5dc33bab3c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "6c35a3d3-eb13-416f-9bbe-3bd7b2826c55", "value": "0BUYA7GaNiooeTq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dad0a82-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "e53f1183-d1ba-4d73-99d4-a6abe2a83a29", "comment": "Malware payload", "value": "4716f34d1939b7b43e968f46386e40ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "442702c3-431a-4a60-b0b2-70e99289118a", "comment": "Malware payload", "value": "9aedb450cd3e1b2b072f0cf4c9a758836fa01f1295df80b2f2f8cf9eea9e2be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "a2bd77a5-f18c-4343-8d4a-3e8a3faf01de", "comment": "Malware payload", "value": "dd77d9c67dd009c5ae00807d67996b53a26e12b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "72b9e68d-b645-4d54-9ffc-3b3e27662cb9", "comment": "Malware payload", "value": "2fea7625e9e082487fd5b72bdc54efe7b519c95e6820ddd3c5d6474d735adb175ea5f2bd81854d8dc5363e334662e5b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "b25de38b-341a-4b10-abb6-7ad042995f93", "value": "T15035F1194E863A99CABE5FB8C1660C9837F0D84793D6D7272FEC01F59AA3B84CD17442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "7caf8eb1-70f3-40e2-ac57-a392b3632da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "5d186f9d-5df2-4534-91ab-c2351f0bab5c", "value": "24576:NxHqqigNf0NSIXtbJXsFxWIvSH1zKu1D:NxHqP200IpJXixWoo1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369391, "uuid": "1c1b99b5-9e98-499e-8f92-bbcdcb0031c0", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369391, "uuid": "4164ce7a-c8ea-409a-8c62-fc8300244cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "d94f4324-75c4-46c7-a9de-2d6e422f3d38", "value": "9aedb450cd3e1b2b072f0cf4c9a758836fa01f1295df80b2f2f8cf9eea9e2be6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d44fd18-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1786370571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "144c01a2-19bd-42c4-9410-9874828cc1d4", "comment": "Malware payload (ArkeiStealer)", "value": "262970e715f1c415a019cb8d6dd769f9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "df7b667a-c763-498e-a723-73084991c31b", "comment": "Malware payload (ArkeiStealer)", "value": "9afc920618109d9bdf027a563d0445df289660e25ad80acb42d5941cabe2f290", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "b974e33a-a92c-4bc7-a680-ecd558242fce", "comment": "Malware payload (ArkeiStealer)", "value": "c5c44545d5331972ac74a3ffe74b873fbfba34da", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "1fc8f596-7e63-41c3-b8b4-cb91f6f2c66c", "comment": "Malware payload (ArkeiStealer)", "value": "c131b6624d7fabfc7bbfc871668b65f6a966ea9bb39a385c4d86a8f1d35d21f0f514e8dd10a3e6739455d37f1d37bf3f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "1267cfd9-b31a-4ad4-8fd1-3eff6c9507c2", "value": "T13BE59D0BBDD409E5D49A927698B242867B70FC4A0F3263D72E80B3783F756E09D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "8edbda10-d126-46eb-be45-9133e6ea567c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "81409569-2aac-45cd-9dd1-dd2bc7adc9bd", "value": "49152:gTudpTwXugfEatDMlOV1/NcPrrplc+aab9BCZNUg883hs9qvkpANbF:giEOZli/IfI8BqzZkpA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370571, "uuid": "8dce1017-4331-4d67-b02c-3322ebce57a2", "value": 3115520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370571, "uuid": "1bd8170f-cd61-4aa6-ad23-ab8ba99f6e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "21b0ae45-a558-40ff-b0c9-e35fff7dff84", "value": "9afc920618109d9bdf027a563d0445df289660e25ad80acb42d5941cabe2f290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04c8308-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786374200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "dd27a8a1-7577-4253-b437-176efc84a9c6", "comment": "Malware payload (Formbook)", "value": "aa6570c00f4d39c1580e5772bd8c6cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "c0aef3ec-1880-4b81-ad53-100db88ac67d", "comment": "Malware payload (Formbook)", "value": "9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "b70e7a18-3e27-4837-91e5-967479493c91", "comment": "Malware payload (Formbook)", "value": "e4d9df5f01a47c816ad140661024487161ea3b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "ab6ed77b-3858-44cd-927e-180227ccd31e", "comment": "Malware payload (Formbook)", "value": "d4e4b43bab2a761f03b8b29a8b2c0fe19381b466a44e39bfa65084435a72d9370d73ba616029afef027a550d59e871e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "3a7cc206-d3d6-406b-9774-a84862911f98", "value": "T14064121727B1D81EDA4B19F08C7AEB7D5FB14F0060A6470BDB20BA4E3D73565292E683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "c0940122-909d-4081-87e0-cc1c4cf07a9b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "cec783c4-4504-4115-b251-87e7f352072a", "value": "6144:M9X0GN6Bo9PMbSDWUOKMRaEUrEjwT2Eryemwrv7zdFx0GYVpm6iNn:C0MOo9PM+vxEMGwT2EfVdvRdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374200, "uuid": "23ef81b0-be25-4752-b12a-d99bf575d2b0", "value": 317976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374200, "uuid": "e79ee0e7-be54-4974-bdb8-9dfcdd18e984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "6b5d4f7c-5af7-47b9-8361-7faa2b10c6a6", "value": "9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6e4db9-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "840ca343-f85d-41b9-ae3c-9a30e9cc8a73", "comment": "Malware payload (AsyncRAT)", "value": "12236c7e2d7acd537eec932ffc042da2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "f3204698-b80d-4fea-a5a8-7828dc58073a", "comment": "Malware payload (AsyncRAT)", "value": "9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "394ed650-0ba9-482a-ad02-7a1548f80bef", "comment": "Malware payload (AsyncRAT)", "value": "9dce57fca6edadb4f1bdcfe9c96bbfd9d89e432d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "d5f13abe-39f7-4c57-96cf-9323bb93c3ca", "comment": "Malware payload (AsyncRAT)", "value": "94235d97947f3e9da3637e8ebde5daa8a0981e46139d61f5eac37740e9048e043501a65057371917ea88689ff9b22e51", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "f9211ad3-2dfb-4e60-a4fc-52375a4e90de", "value": "T1A2F4125C2A49D903CA6543B58FB5F37862A95DFCB811C3139FEDAEDFFA25A008C44186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "97dc2052-314a-4668-a7e9-9606861f8384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "29bde7cc-5d5f-491f-9a0a-6919532a10b8", "value": "12288:DlJdbv0EcfJGtMQ8YMtkJf89E6OuoQ4P2dHGzPY7+V0MP81fTY48kCRKwicUL:D7cfJGtMQ8Y984CGzBk9TYVvRKwgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371508, "uuid": "43b3145f-b66f-4bf3-8fbb-1e63ece9b071", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371508, "uuid": "6846f478-5f36-43e1-8b52-123c85fa97b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "51152af5-fea6-4910-8513-6098f1a7d3aa", "value": "9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2681bc-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "87ce5e7f-6ae5-4f90-84ba-afc9beb7b987", "comment": "Malware payload", "value": "0e4945852c609c6f29e078e5d1301b39", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "6c60216d-1ff6-4ab9-82b1-535d00aa89c5", "comment": "Malware payload", "value": "9b21a1cfe97d251f28879b61514f00d5827c8cc42e863e1712d748423e703159", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "f9270a06-5aeb-4787-8031-e3ae189a6a33", "comment": "Malware payload", "value": "166dcb6f2c884534504058f069831d705b400ad2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "c542f38d-a1a0-49f1-bbc0-b4bac285403d", "comment": "Malware payload", "value": "367476a11f7ed099ee96ef417517c7aaef687402e6fe30cae11d68d3d81af6ca8c2392b5d7f5749a3e4508910c3a1ebf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343028, "uuid": "6e276297-66d8-45cc-bb44-ee5cd3673095", "value": "T107236D6626857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343028, "uuid": "6ba24199-1f46-43c5-8c57-2b2a0c66d3cd", "value": "768:RXRWNGxVG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:rlx9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343028, "uuid": "1c13b78c-3ee9-49e3-b144-792a06ba429e", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343028, "uuid": "bc9dd644-a38a-417a-8b68-995912970122", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343028, "uuid": "6da0fc28-11b8-4bf3-92b4-aaef067729ed", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b8406-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "177e8eaa-8b3b-4817-ba17-f6a0d6ba4a43", "comment": "Malware payload (AgentTesla)", "value": "75a3ad7ba10a98390641b21d90c086fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "7b1faa88-7852-4376-955f-81c427a7c75b", "comment": "Malware payload (AgentTesla)", "value": "9b2e17315099fd4f4442500c739242b54f4ab424f809173b9a1bf84de0d28ba6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "f324f2c3-63ef-44f2-8ed1-f99883c574ff", "comment": "Malware payload (AgentTesla)", "value": "16a1d4f3fd6d4345b806753e5fd14aab69334083", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "1b97848e-07c7-4568-8a26-71e959281f27", "comment": "Malware payload (AgentTesla)", "value": "f4befdf0b79a3d933852b5077f5ac5b979ac473e051709dc02938bcc5f4607d8344ac44bcffd3a643cdab68aa63b51b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "cc322417-6b3a-442b-9252-48de31294f5b", "value": "T1313501551312DE42D0D68BB7BA60D33432B50DCF79E6C3929FE62FF738193921968682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "07a0a98f-9b3b-41ca-b08d-67e5654eb97d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "913be971-fa5d-4100-be16-2419ace6b75b", "value": "24576:op50w2pHAqmtk1z5UrlE+hMsRQF7gYLxFdqhWFtrYcj/P:opR6gztIW++hMsaF5/tkY/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373172, "uuid": "d039150e-a4d1-410d-963c-73ebd47c4c4e", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373172, "uuid": "9f060098-08a5-4f92-aff6-83b1f7ad13cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "4c3e596c-193a-453e-b472-320803b7d5bd", "value": "9b2e17315099fd4f4442500c739242b54f4ab424f809173b9a1bf84de0d28ba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28dad80-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786369560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "9e1e7a15-827f-441c-96aa-bd037cfc9c03", "comment": "Malware payload (DarkTortilla)", "value": "cf3bded02abe1fa1caec1a8962f61791", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "d6f794e1-df2f-41d2-bbe7-fb21364b33c9", "comment": "Malware payload (DarkTortilla)", "value": "9b6ac075584a853e270eeaf480e0baaa415ca187b54c5c04c53bfb3d3aa87a1c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "ea2568c0-8e18-4090-afb1-cd00482afe51", "comment": "Malware payload (DarkTortilla)", "value": "2292456956e0da4d0c9cbf5d765e7a112819b57a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "85ee9a63-012d-4eea-9282-1f77cb8a954d", "comment": "Malware payload (DarkTortilla)", "value": "5fa187993da040a762becd876f5d36f4b36182f976fe21a78d6c4821714da6d0c4110d887a021f0afc1f924ac9d352fe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "38f3699e-2717-4641-a755-dcbdbe0b82ec", "value": "T13B75E0275D8261AACCDD5E34C278365C63F095CB2303DB922AE822F99F73B466D43C56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "5fec46b3-7845-4dda-89b6-2347241573bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "35e63845-7024-47fb-bb52-4029116b3c75", "value": "24576:48qqigNf0NSIXtbJXsFxWMa6S3JpITsIra2eT6khAnWeWe42Hn4j:48qP200IpJXixWT6BnuMWeBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369560, "uuid": "55a4e67a-7372-49c3-a42a-245831ce9ab1", "value": 1688064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369560, "uuid": "2d5c5fe0-2ac4-4e77-b81a-941a243f1929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "bd88f868-2677-45bf-9b4b-59f3e9e17e6d", "value": "9b6ac075584a853e270eeaf480e0baaa415ca187b54c5c04c53bfb3d3aa87a1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d3ab53-94ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786389373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389373, "uuid": "5de213e6-1fb4-4571-ad91-d0bb7dde660d", "comment": "Malware payload", "value": "98ba8782e10c9592f17dddee12bbd7d7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389373, "uuid": "c0bb6181-a3ee-448e-af74-72784df84138", "comment": "Malware payload", "value": "9bd2cb4000ba90c8ebe57799a5edf3b2fee9555a2a5eebf40e091e45ef78edb5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389373, "uuid": "b59a2abf-e6af-492b-8697-554059e830b7", "comment": "Malware payload", "value": "c9f2f957a737f07f8af7386c37f455b66d477869", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389373, "uuid": "a3162f70-06ab-452c-97c6-bdab8b599c38", "comment": "Malware payload", "value": "1fc178881f36f073d65f9b239ab4c02a362f6a75f030a0b9ce1830126411f4fbc65a174e72e9461b4c1ee84f826b49e1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389373, "uuid": "a4b19b99-e83f-4f9c-a8a4-95f134ffd41c", "value": "T1FDF523F579D62EB1C027CFF5C06AB67EB53E37818A724C1B77E92A410A03111E2B6752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389373, "uuid": "2d410ae1-1399-444c-8d89-317ae8fa6c88", "value": "87580c9f831b0b6a1af24fcaa64e61ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389373, "uuid": "e4271f8a-1dcf-4e1f-8717-e4c042782610", "value": "49152:GfzRaQ6hh7Owc4BWUVA2TtQZd3IXuY81tCOxHzT4odEqMen6ftqZ4x6RZm5mnttj:GfzRlg7XBn6uXjSAOFjdEqgx4po85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389373, "uuid": "1290cf22-613b-4843-9ff6-fa8f6e7310aa", "value": 3506456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389373, "uuid": "8fc30c8b-bd4e-497f-bfa0-dd847e2fed2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389373, "uuid": "94a2ea78-880f-48eb-a8c4-0ebe61098e55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f844b6af-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371341, "uuid": "cc211a77-628a-4f8e-87bd-2811b109654b", "comment": "Malware payload (Formbook)", "value": "6c2afb49bde68bdf034b36a519f0d145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371341, "uuid": "8d69ce7f-efe2-4c48-8283-6bd2932e69ba", "comment": "Malware payload (Formbook)", "value": "9c731d733ef1cab6428ff8da1e25c580f4ce885993ea3fef6f0b1a908be1155a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371341, "uuid": "ff337799-f103-49fb-b7e3-010b7ab8ac1a", "comment": "Malware payload (Formbook)", "value": "e06348d58cb4fca9c9b004b07c04ee24b46ccc52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371341, "uuid": "c6f34db6-a991-4d88-9b1e-3740d97dcd12", "comment": "Malware payload (Formbook)", "value": "aa88a6bebcde72b8fdf81376207912b75e51fcd7eb8e368a546363965d02d47dc19b34bc2a136428d7630cf00d9c69a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371341, "uuid": "c35abe05-15d9-4d5d-8b92-8db3430ead4c", "value": "T1A9451214A359E523CA4567394AB0E27523F99EEEB401D3458FE8ADFF7832F024D18297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371341, "uuid": "5f15696f-03b1-45d2-8148-c70c86ed6d96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371341, "uuid": "0dba4fc3-087e-4695-9d34-41bee4649fb8", "value": "24576:5V/7tVqg84WX3n6X5NCewEqnJaLHDF/ELMfr8Bcwz:TtcXKX5NCjEqnJEZckr8Bcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371341, "uuid": "f43d84e2-298b-4fa8-a4bd-a5f9a67ea3ae", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371341, "uuid": "effd3c57-455b-420c-800d-0b6d89eef566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371341, "uuid": "36eaf656-2a39-4a49-a58f-173fd7752426", "value": "9c731d733ef1cab6428ff8da1e25c580f4ce885993ea3fef6f0b1a908be1155a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79a022b-947e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340739, "uuid": "ad31a5c5-d11a-4ef0-8e37-ea0e46c39e02", "comment": "Malware payload (Mirai)", "value": "6692851f97b0c121974abff719110c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340739, "uuid": "b5e45d44-db10-4102-94c7-0ef816d08ebc", "comment": "Malware payload (Mirai)", "value": "9c93958e3500842eb050e479373376c756bce356aae24c34a99ea63952420045", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340739, "uuid": "5686e758-1c7a-45b6-b71f-66195964727e", "comment": "Malware payload (Mirai)", "value": "18baaf9a33cc96ca9a91e60c74c0cf5b79e1e4f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340739, "uuid": "ec8e88be-5881-4cda-8625-8ff6993dd9b0", "comment": "Malware payload (Mirai)", "value": "dcfad71248cd5e6953c01986496e595af37967883784d84c6be6a7b800ae40b3524ec866709404f2f4fd2e774c5c5f6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340739, "uuid": "463019af-e665-4e03-9351-63d673986683", "value": "T14FD54A07FCA544AAC4AE92358A669252BBB1BC484F3023D73F50B73C2F76BD099B5744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340739, "uuid": "d019607c-bb16-4f52-9266-0d8b7cdfaf0b", "value": "24576:slhALf9x0YTxOHjehyWeiKp+ooDASb+ry+vqBsTq1+hg+NZZqFm6Hj+XZg5t0DqG:slhUlCYliGyli0WDASae8dqvDnapEw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340739, "uuid": "ca7ca6ae-c605-4c6c-9a86-3d43a4156d32", "value": 3010852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340739, "uuid": "98c383f8-5083-4d1f-89ba-8b8588d52b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340739, "uuid": "7ace65e0-0f89-4e69-b4b6-fa3877f7279f", "value": "dvrk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e41bf1a-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373687, "uuid": "73195d22-e8ac-4db6-beec-58fa4ec5222e", "comment": "Malware payload (AgentTesla)", "value": "337145807ce3c4d743ae873953bdaf95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373687, "uuid": "a0b36423-56e7-4d76-90d2-5ca49d8b499d", "comment": "Malware payload (AgentTesla)", "value": "9cb3d7c4b9f44b587f216692e29dba2101f72d315def405eb1291383d6629855", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373687, "uuid": "6dbcadb8-254f-4d4d-bde5-5bcff53d6858", "comment": "Malware payload (AgentTesla)", "value": "36bd300a62920555cb1f07ffd53b3e19b28e928c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373687, "uuid": "86117eb2-b672-4448-96e0-b9a309b9d000", "comment": "Malware payload (AgentTesla)", "value": "5ca7bf643d9c9d57821182967c3f71ee54eaca0396af987f2a485e437f9bf3961a8bbdb2818a3ade72e8840cbcaf759a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373687, "uuid": "55e7c3cf-6b22-4a57-afeb-0c386f1e6979", "value": "T1761523927B615716C6BB4BF908B5E67203B81DAEE830C3098FEA6DEF7557B240804753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373687, "uuid": "8397dc84-b1ef-4e78-8e4f-371ac454e69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373687, "uuid": "dff5c9df-a989-43a2-a332-10f6321aefe5", "value": "24576:mA7jOQlD7ZCH6Vw/Hn9bNQDu785aAMgP8XUU4zIzR:7OQnZoNHQu785aAMv74Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373687, "uuid": "bdf9ef05-b05a-4c9c-b9d1-340b8fb3bf90", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373687, "uuid": "708a866c-05a0-485f-8883-90620b4f1881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373687, "uuid": "7df8c1af-fbb7-49ff-b25c-cbf62a0cc25c", "value": "9cb3d7c4b9f44b587f216692e29dba2101f72d315def405eb1291383d6629855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da73d88e-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369144, "uuid": "05c23e37-866d-422f-addc-889328e2c67a", "comment": "Malware payload (Vidar)", "value": "ed629e6d5feb7820f847962a8eb59bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369144, "uuid": "45717e21-b67e-4da4-87ce-8f2fb34ad7c1", "comment": "Malware payload (Vidar)", "value": "9cf51a3734eeee7fb89c31311c8be9563e82121185d0ad665973aa11f8d81cdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369144, "uuid": "82bb708a-13f1-45c7-8b63-708c47bb4cf9", "comment": "Malware payload (Vidar)", "value": "ce99ba66c33dd1ded8b3ef974e053ca6b2caca65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369144, "uuid": "6b1077e7-1d8e-4c41-b20f-534b419008c0", "comment": "Malware payload (Vidar)", "value": "e3c1f045dea9e4fb358ce5223b6aebcfa4d3ca23f6040a1aefa825ca1a99b84e85fae1371885bf201315eb2ecdab0af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369144, "uuid": "9be8b6b2-ff06-4053-82a9-38f9141cba84", "value": "T10A5207C6B09370FCC0A9C33E8A4612B7E7A1345507291ABF43DDC6686BE279179786C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369144, "uuid": "e6de337d-f4d8-4698-aa7d-a36493ed6e55", "value": "eaaf60cd5c7253068dcdb6306a8561f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369144, "uuid": "81945f8c-a3a7-4c3b-8a2f-f44a42f5a8ea", "value": "192:TIC2noU1JUnyI5kP4mKhca8XJ74ZPR5b2tfvaY+CpMuAYMm/uzLyb3VRPiCIf:TIC7U1Syf5VN4EtHjpMuAVA64lRPFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369144, "uuid": "8e70cd84-95a7-43c2-a973-70955a97ff80", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369144, "uuid": "80013521-0674-4e96-afd5-ec03d26e00d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369144, "uuid": "298b250b-52d0-456e-9b7c-df56e95f6f41", "value": "9cf51a3734eeee7fb89c31311c8be9563e82121185d0ad665973aa11f8d81cdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc5cb6e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786373951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373951, "uuid": "74d39de5-85a6-4903-831d-910cd58bc72f", "comment": "Malware payload (Vidar)", "value": "ca392fa049454d7e0df53d36ece744ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373951, "uuid": "eeb21360-3db9-4134-a786-c55b85241dc5", "comment": "Malware payload (Vidar)", "value": "9d1e77734deeba795a937e36e8c661b961846852d73ee90d56e2a5cf80438c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373951, "uuid": "df198c63-b27f-48a7-9e05-67812b18ef47", "comment": "Malware payload (Vidar)", "value": "121d8d334ad57d5dd23faddeaef329c116f4b07e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373951, "uuid": "72f0244b-0488-4374-9a46-8a3d5a290579", "comment": "Malware payload (Vidar)", "value": "491da4c736cdeb27b3c111dc7c16843b694de23095996afdec1d0f102a32a8dbf85a752eab98fb00c31a0aedcd95c71b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373951, "uuid": "c8454cc7-e012-4a2b-9534-287118ad5795", "value": "T158767C07FC9149F6C0AA933189A35252BB75B8181B3227EB2EA0B6783F737D05D35758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373951, "uuid": "0a9e25c0-cf28-496a-a8ac-8bc821484ed1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373951, "uuid": "fb049eb6-a34c-4bf1-9d4c-0a7ec126aa3a", "value": "49152:kYbJhn8kXzm481K5XXA4DjLva5Nf2EfSM6HJoTkgAwqc:kKTCOXBj8Nf2qSM6HsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373951, "uuid": "d0e4fc95-ece7-4a75-b2c2-efff2f396349", "value": 7569920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373951, "uuid": "fc2854ab-1559-4bf0-87be-c020376f2621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373951, "uuid": "399b79d2-3f31-4869-aa4f-c5292fe946fb", "value": "9d1e77734deeba795a937e36e8c661b961846852d73ee90d56e2a5cf80438c2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f21cc5d-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371863, "uuid": "02888052-fa74-4cc0-a1b7-f12ace86d357", "comment": "Malware payload (Formbook)", "value": "038f3a474699f0d8f70705e60e265e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371863, "uuid": "56d09f35-d15c-4d37-a6b2-11d68f01e182", "comment": "Malware payload (Formbook)", "value": "9d4c6ee2991e408f7dcdd905ed638d5e9538448536cb5f047ed7bcfe679cd377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371863, "uuid": "d9133b0c-eb63-4230-a561-37c90fa0f946", "comment": "Malware payload (Formbook)", "value": "9a2b4ef979593d2d21403cda1c3faa8f59b3e8c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371863, "uuid": "0aaaaffa-aa5d-4f97-b1c3-8050da807bf1", "comment": "Malware payload (Formbook)", "value": "36c03f888bf4181115c6ca9b8865f025d9850b8f8eccc331589a8484d00d5670305bb1dfe0a6db3d22bde336f5a73114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371863, "uuid": "9f48ed27-ab17-46af-b20b-72df816db37f", "value": "T1F9252318DA1BE113CD0107790EA6F3B8267D4FD99913C627ABDD2FA7FD26B198C14242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371863, "uuid": "ea5bf89e-488e-4023-90da-53a044417f5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371863, "uuid": "ecc602d5-b9d9-4780-8b29-01154a35272d", "value": "24576:rPPuiGIxqyU3V+AfothGm1gkLmGOK5DSbMIm+8:TPuiD0Lo7GGgQmGOK5D5j+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371863, "uuid": "98194882-9d32-4726-b00f-440c7a05641a", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371863, "uuid": "fd70e504-153c-4ddd-abf0-d11c1398a889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371863, "uuid": "45b4741c-3b66-4ce3-9baf-a8f3cd67592a", "value": "9d4c6ee2991e408f7dcdd905ed638d5e9538448536cb5f047ed7bcfe679cd377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bafed5d-9487-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786344396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344396, "uuid": "49fd7cc3-751e-4447-bbfd-432236f4a4b6", "comment": "Malware payload", "value": "d6b9b3496189ef78f5267a3556ab5b6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344396, "uuid": "c403546e-bca7-435a-8cc2-c4615100ce49", "comment": "Malware payload", "value": "9e5e2dc261b3fc11641d18ba148dac6564df0692efd6ef3840327d6d73923b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344396, "uuid": "8b0e2ebd-6a01-4825-bf18-a68ee12865ca", "comment": "Malware payload", "value": "17ae22224d38ed59acf6933873f665e966ca03ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344396, "uuid": "25557209-4a91-4ae7-8bde-cc6ff626b490", "comment": "Malware payload", "value": "061b89c61be46a94615233dbda7128344edab2264bedcb59832d827a57445f1c7cbe04d1de2d8b34451991141ec9c31b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344396, "uuid": "69a72c6d-2b95-4f4e-85d5-d7f5cc068a4f", "value": "T191531A23FB0C0466D8936DB80E7F07E683155D5220FED115650E6EAE1732F30A687BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344396, "uuid": "1300aa98-399e-4106-8701-971bd278349b", "value": "768:+m6mow4jq3ovFuXGzuVuvuvKfFkZWyn4ISHK/5pz3nWTmwZ+Vs1ZKer:+m6vw4j7uXuuMvyWyn4IwojWTm1Vs1cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344396, "uuid": "9509f681-5157-4145-9dc9-33d2986253f1", "value": 66376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344396, "uuid": "ebafc18c-e52d-42a1-8bc4-46377f270b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344396, "uuid": "ab407284-9434-498d-98c6-ee82e50f0bb2", "value": "main.ppc440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdccdcc6-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397013, "uuid": "3aa49dd9-9d17-4336-ac26-0db9d67c76ee", "comment": "Malware payload", "value": "dfb3961c46af0ccc7df95f8fe168e22c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397013, "uuid": "0664c65f-838e-44ff-9d2c-b2e651845f6c", "comment": "Malware payload", "value": "9ecbfe69a9512df4d74492c29a4b8bf351f0b5eb4d04dc6901c48c31799e2ad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397013, "uuid": "e65300fa-9cd7-432e-81de-26fb595535cc", "comment": "Malware payload", "value": "f4b8f6199232bad460137f06f359f633ce22415d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397013, "uuid": "dc3266c4-0a14-46fc-bea5-67900dad670f", "comment": "Malware payload", "value": "917fba41ff02deac428969138322c18252fc75abf0455856d0ed26b73316f23331af1a12e3c756f8c1bc7dbb8e28b56c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397013, "uuid": "4a9adbc9-6d2a-4195-8e32-2bbd15f57bb5", "value": "T125C44BD4F2C65E7CF00659325E83DB16D6126FD2E3285BAE852507492D8CBEBCF32168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397013, "uuid": "325ea846-462e-4d94-94c4-37037b29f17a", "value": "6144:CmN4kMUJSfg0JQOE2XTwozFpvk7QlOdMgDyXUWo3yLsM1Av5fgWQpZSb8a:Cm2EOJ7GkvkZXyXFyyu1QpZSb8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397013, "uuid": "ba355b63-1a2b-45b7-bba3-1f58b90726f4", "value": 566980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397013, "uuid": "40b325cf-80ad-45f5-8b4a-8fb3bc06d7b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397013, "uuid": "92f15870-0735-473b-b30a-6a99540b13a9", "value": "main.nios2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc39b280-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371670, "uuid": "1e2833f0-7769-4cc8-a68c-2add3d15b06e", "comment": "Malware payload (Formbook)", "value": "b119592a8c6de1db9b732d1898bd7507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371670, "uuid": "3ec33aa8-436f-443d-a664-46097c342f5f", "comment": "Malware payload (Formbook)", "value": "9efcabc4472ffea1b885979aee38ea41212e469280027747f02a307c59d98bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371670, "uuid": "fe01d4a6-11a7-4724-80ce-bbff4024cc70", "comment": "Malware payload (Formbook)", "value": "a45dc0d0a9ade758668a4656c2921c17e5c0baf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371670, "uuid": "227c95fb-46fc-4420-8d97-0304a4198059", "comment": "Malware payload (Formbook)", "value": "c30c1cd92cb5cac0defc10d3b8821ac8f4f20767db3a5648b6ba228b8e08ef080ed38a5f0130a6cd8474eb2c74572309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371670, "uuid": "8ca691e3-aace-4cc7-a351-662dd9fcdda7", "value": "T19D2512186655E503C81167365E70F27423BD2EEEA911D22B9FEDBCEF3932B186D20187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371670, "uuid": "79e81262-efda-42da-a498-f48054faf597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371670, "uuid": "8ddd3daf-9bba-44df-b350-0219522fa07c", "value": "24576:rQv6ptnAYMR7/QW29R+5XYDzyezfcy2JmxB1qT+2+rTs51jMocHvl4:vceWSgJYp/1xB8T+N451QLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371670, "uuid": "e3568a6f-eae9-4912-8303-dda743c2dd7c", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371670, "uuid": "bcdef55c-7e5d-4855-aad2-12baa6611f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371670, "uuid": "1b1f2c7a-45d1-498a-b143-f961b0140ae1", "value": "9efcabc4472ffea1b885979aee38ea41212e469280027747f02a307c59d98bfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f56af90-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371595, "uuid": "2255d3a6-3fe2-4840-b5d2-3e0901d97131", "comment": "Malware payload (Vidar)", "value": "ab5dba407c9ccaea84badd9270cf3c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371595, "uuid": "d2a400c6-f114-4307-9aaa-d6b465b51776", "comment": "Malware payload (Vidar)", "value": "9f37d38ffd76c6ba989f1f6e804c3375a5c12b162e443df51b2c63f9f81d73f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371595, "uuid": "edbbe048-ed7e-4c50-8811-440357e86552", "comment": "Malware payload (Vidar)", "value": "51e095013408d0be79570edd85491ce850c2759e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371595, "uuid": "04799f79-858e-4201-9b10-937f93aa79d2", "comment": "Malware payload (Vidar)", "value": "6113ddacd6fda2823a2304a57fcabcbef4eed0630cdfc123cedae9ded6d0a4fcb343f52a8db72799a6d786acfe5f8d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371595, "uuid": "e4a30f52-2073-43c3-b01c-31ebad54bbe9", "value": "T1B1423C84B392F0FEC66DC37DE5AF256169B6700413244EBFBA7A44C05E83312B23D669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371595, "uuid": "71ea2b7f-9069-4cdd-8f4d-27435aa16e03", "value": "4771e6f45e35660c0a3e9d4423dc0d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371595, "uuid": "572a8d47-4cbd-49e8-8ffa-6d648369ffa5", "value": "192:OJCrZ6Nw+ELEXjSidGVkxJv+95f65p/BBlxAe5h4mvxaY3VO3Vw:OJ3C+Q4Jv+952/HDAkh4KlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371595, "uuid": "fffe6cbe-1740-4565-8ad7-02ff658ea2f6", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371595, "uuid": "bfd585fa-744a-460a-9f5f-0a03b6fcc396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371595, "uuid": "db74e0b3-cc41-4e73-8cfb-b5c1f3d1aa76", "value": "9f37d38ffd76c6ba989f1f6e804c3375a5c12b162e443df51b2c63f9f81d73f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d4ac29-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368781, "uuid": "b971ccac-445e-4e52-981c-8adde4789734", "comment": "Malware payload (Formbook)", "value": "1610df2e709efca2420251438a674374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368781, "uuid": "5d983c8d-6ddf-406b-9c60-dd7a6854e765", "comment": "Malware payload (Formbook)", "value": "9fd220a5ddfe293be42d2fbfc09f0c1c17f9da011f6eece94c47b43be3df8dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368781, "uuid": "908e4f0b-8283-40f2-a552-8c68066f9ed8", "comment": "Malware payload (Formbook)", "value": "b56a79cefb4c8f2ac38f11e3ce9dc668ecf5b6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368781, "uuid": "cdb93411-ec40-4227-aace-6c028e3aca64", "comment": "Malware payload (Formbook)", "value": "b51ba31c808364fa7c0e974540682bd206c1ade0d15b2a596157ff64b3e79be136d10bb589969b386f7e153047400aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368781, "uuid": "95322421-0093-41cb-9726-6fab9dfcc128", "value": "T1D72522006394CD56D8E64BF966B1E33113B07D1EE529D39F8EC9ACDF7A61B001894B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368781, "uuid": "1951c43b-8424-4536-aaf5-812094b9b823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368781, "uuid": "624c0363-b259-49de-b63a-bada1c9722e5", "value": "24576:nTsaBSsJ/1QerDV7P0xI51U8wPUT5ULggePQ4:4aksNqeHJ0xIQ88i5UL8Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368781, "uuid": "ec8b5816-1a0d-47cf-a9b3-779eb7657769", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368781, "uuid": "ee4fd39a-4910-4a41-8695-9ddef70b6491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368781, "uuid": "41034f87-4279-450e-810a-8471e160b372", "value": "9fd220a5ddfe293be42d2fbfc09f0c1c17f9da011f6eece94c47b43be3df8dc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212c0683-945a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786325024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786325024, "uuid": "57b5c02d-13a5-4cb9-830b-d0f3656a3620", "comment": "Malware payload", "value": "7eb1253e53ed997951f541680b445ee4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786325024, "uuid": "141db2a3-d2af-4485-8055-02a213d1f6e6", "comment": "Malware payload", "value": "a0006e9a7a2dbf8e1245a3d6e0847130b337a463ec60b0f0c7ccac3a244303f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786325024, "uuid": "f3449d53-a206-459f-8b50-740e96f77f1e", "comment": "Malware payload", "value": "c7b819f3aa965fb890dadb1b1a80280ba66a666b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786325024, "uuid": "3091115b-a02c-4c47-aca9-16218ed1a534", "comment": "Malware payload", "value": "0139514a564ee97dd4d8f12f1b41935eaa2a3c38c42b09f3112b890dc8c123ebd8cbe24351d8bde3c0d0fe58b8e47b4e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786325024, "uuid": "f71e8063-a5fc-4d4c-becb-607181d76b3f", "value": "T108235C2516857C24AE98C4361C7E2F0CB9AD43E6324452EEBFCB3CF68C4A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786325024, "uuid": "ea4c9d99-79ef-4f56-9a03-e2f737d893c7", "value": "768:9+IG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9+Ijcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786325024, "uuid": "431354fc-73f0-404d-a003-80d6e86b61db", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786325024, "uuid": "0d0f0308-bf3c-4578-b427-bb8737de0dd9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786325024, "uuid": "8bed1cbc-15b1-40cd-acac-03c25b5370b8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cc1ca8-94f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786391653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391653, "uuid": "8a738dd4-1961-4b67-8fe6-f97f5b3683b3", "comment": "Malware payload (Mirai)", "value": "2ae24ebb7bd8a7c7282d812f3d8232ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391653, "uuid": "d3a8dee0-c6f5-4ef1-8296-19a851b29bfb", "comment": "Malware payload (Mirai)", "value": "a02da4c8692bda271149515d0ea35f0dd08f4199da579e6294f499c6e4585bb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391653, "uuid": "06070038-6f27-4de4-afe2-eb286df50df4", "comment": "Malware payload (Mirai)", "value": "25917085ea4efcef819dbfa1426822c24a93a849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391653, "uuid": "19e3fcb2-4246-484a-8a52-66c5afe15a56", "comment": "Malware payload (Mirai)", "value": "309efea71a9c8128520ede4ed9630ed79c48f7549a531599e395ca7267b1055c850be68b0ce5327254c6ea366bff4cc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391653, "uuid": "0533e632-a6eb-4879-907f-a849ac562ad8", "value": "T1DDD30659FD41AF11E5D635FAFA4E028973530B6CE3FE71029E245B2123CAA6B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391653, "uuid": "eb7155e0-f4b5-4286-9ebb-8b839d0183d6", "value": "3072:ocxfTlDs1+u/hmQyUjSPMgQ/aUYW7Ita1vtZhh5uaAFow6zKGHQ8:ocxfTlgxbLW0P/aUJ7Ita1vvBuzFow63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391653, "uuid": "606e0d9e-2c08-4fcb-a154-7ea86be597be", "value": 136928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391653, "uuid": "52e8aceb-2a18-408e-9312-3ba4d91f896f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391653, "uuid": "afc80bfe-f847-4f80-975f-26e41f0847b9", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e733d478-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373031, "uuid": "4519ff97-fefd-4a34-b8ba-815a0fd12a73", "comment": "Malware payload (AgentTesla)", "value": "1c493b656129ad087671e0ef1c1da22b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373031, "uuid": "26eccc19-7dba-4ab9-94d6-17ad3af10369", "comment": "Malware payload (AgentTesla)", "value": "a0b8d0c6f8478a8082dead050ea904f40f6b7b5149a908a473af6f2ca6572689", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373031, "uuid": "92d065e6-47a8-44fb-84ad-d77f49b88338", "comment": "Malware payload (AgentTesla)", "value": "5698a2302c4839edba3ecc006a11eff51d9e5ddc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373031, "uuid": "08ea8473-69a4-4f6b-8835-987451dc44b8", "comment": "Malware payload (AgentTesla)", "value": "3207d8a22f9f848938446a9c2d1d74a1933ebb369c783f70f467ff457fc4ed0a68a64cad0c4649d9cb1b9893f526ec37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373031, "uuid": "32c4516b-a71b-43b5-87d9-9d3c7eacf4da", "value": "T18145E05036238C82D07B8BBED861D37416B44D8F70A3D1DB7AE82F7738187C9458A67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373031, "uuid": "c76b9088-8f06-4e9a-ac73-e773f05fb879", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373031, "uuid": "a7d1ec3f-4699-4dac-8727-257144f6c8ee", "value": "24576:IRp50F25dz+eN86SMqtB7uflf84+Ce/Lpr:WpO2PhHSMqr7SJeTpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373031, "uuid": "bd930757-cc81-4848-b1be-69c00d288dbb", "value": 1250304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373031, "uuid": "23d65d32-890e-4b85-91cd-2f437f94e32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373031, "uuid": "99d5805f-5594-4e69-ab8d-9f11ca8f71e8", "value": "a0b8d0c6f8478a8082dead050ea904f40f6b7b5149a908a473af6f2ca6572689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4432c74-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371335, "uuid": "6197653e-ddc5-44a8-8e7e-e31379368ece", "comment": "Malware payload (Formbook)", "value": "e344f97fb01b87c90e275d2f367ed0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371335, "uuid": "f9d1b90b-170d-44f2-ae3f-ea88b9676131", "comment": "Malware payload (Formbook)", "value": "a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371335, "uuid": "92328d4b-abc5-4087-a057-b2211ab58163", "comment": "Malware payload (Formbook)", "value": "03e451291906bb915fa797d94e8058c4db84357a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371335, "uuid": "ab5caef9-f426-4915-b569-701be590dfa7", "comment": "Malware payload (Formbook)", "value": "6c0e9dc2439012e963af6bda3c1dd9e7bf2370eb8d6c46132b5511025bd88884a380de60ffa323802e35dc16eaf26a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371335, "uuid": "18e19244-9816-4288-b150-f7926f5e933e", "value": "T17A4512507210D61AD48527384AA0F3FA02B95EEEE901D71BDFEDBDEB7839B024918753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371335, "uuid": "ac751735-fcc3-4bd6-aadc-7dd93499b2de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371335, "uuid": "548020b3-7d81-4cbc-82bc-76882c5f969f", "value": "24576:GV/jLDh75WximT0hJoEHQno/7ZU6XL0UFp8BgqW6aV:O9QximT0joOQno/9X0UFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371335, "uuid": "28e79391-ba72-4add-94a9-a202985b899b", "value": 1178112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371335, "uuid": "5f6da6bb-5440-4106-a0a9-eb192069a0f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371335, "uuid": "a3d4b9d5-862e-42f3-aa93-9fd0e8ad0e9f", "value": "a108b49bbe1c24a43ba4dda7330263f02adfc22e2d465d6a83dc1eed0af7295c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152442c2-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371819, "uuid": "28c271bf-6acf-40d1-b091-640899698b25", "comment": "Malware payload (Formbook)", "value": "773ee6cdbe23a3fc6b62331121a12857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371819, "uuid": "2d4d1478-172f-4c0f-a5b2-b9fa8a1686ce", "comment": "Malware payload (Formbook)", "value": "a109e758dc12919be0d48ce0344e79cd6c2159b4eb0226a328e0bc67f34f4a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371819, "uuid": "7927a565-ce22-41dd-a939-7c0c3b17188a", "comment": "Malware payload (Formbook)", "value": "8f2d7c65bb68caac3a7ab4743018e10b5f0141c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371819, "uuid": "cbd235d4-c3b1-4dd0-92aa-75a2c22c0aaa", "comment": "Malware payload (Formbook)", "value": "563b1efa65fc124bfd4170c2d28d20b95a2b2e10db0c9fe9d3fd732b7e257da73a32f83efd0001866661b8a5b5b32911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371819, "uuid": "e4bcc3ec-1533-45a6-8bdd-fa2e3cdf44e0", "value": "T1182523181955D917C66007B86E22F3B86679ACF96C00E343AFDEADDFF923E149C440E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371819, "uuid": "e72406e6-396c-462f-8dea-b7991a60a3d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371819, "uuid": "dde59076-445d-480f-8e18-383b083d1947", "value": "24576:KyAjq2NuIyVH0vQuHsHAJsg3rM7RDnWD:KyAPz3YT05bQ1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371819, "uuid": "405853eb-2d68-4750-9fe1-7820dbacc7bb", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371819, "uuid": "7efbdcd9-f807-467b-be01-69f7354968f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371819, "uuid": "4e8fbce8-5371-4c24-91ff-21c35307edcb", "value": "a109e758dc12919be0d48ce0344e79cd6c2159b4eb0226a328e0bc67f34f4a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e87e66-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368202, "uuid": "ea98da79-e58d-4a06-b264-355615039df3", "comment": "Malware payload (Vidar)", "value": "7fa2b0966caf09dbb6385677e1daa908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368202, "uuid": "c3a1b650-8b07-4089-83be-a8a27fdaa9ff", "comment": "Malware payload (Vidar)", "value": "a1f9df69d55a8445b2fa704bc3e8fbf80e80049fe07c9c4fe50fe9ede5a2bc3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368202, "uuid": "3e5639bd-b501-44aa-9716-10598f487362", "comment": "Malware payload (Vidar)", "value": "a6917158aa1f1e5481bc48ca544f311f293e61e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368202, "uuid": "390edc3d-b51d-4c75-bb1a-eff5cefd4a2f", "comment": "Malware payload (Vidar)", "value": "8897e2d277930351b840289c58fd70dc949799792e974c7b444d4b1cd186e728c92ed0ff1d9058c4b989d836014cdc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368202, "uuid": "b88125bd-eeb3-4995-89b4-8fb32fca68a4", "value": "T16452F9977293F0F4C1F98378CAB61277C6663085632D2FBF11EC85107A82220B579B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368202, "uuid": "1ec6925f-ba60-41bc-a591-9dd8332ae8c8", "value": "1cbfefce08822faeab3ddd0a4a3750f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368202, "uuid": "3a6b6da5-3367-476e-ac35-90bc20cdaa49", "value": "192:O8mYa2VekbKYNq9jaqvq/997uDwBouKjXMXIeoViSm31Nl3V:Ox2V9m5hafLmuEXM4jVxoDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368202, "uuid": "4ec1783c-7025-415b-acb2-d1fe742623c4", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368202, "uuid": "d117b9a9-0d00-4283-8cd5-6b9b7f586d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368202, "uuid": "8a4ec89c-b9eb-4a48-9af6-bf2b7464001c", "value": "a1f9df69d55a8445b2fa704bc3e8fbf80e80049fe07c9c4fe50fe9ede5a2bc3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0976377e-9476-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786337011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337011, "uuid": "c32200f9-61e9-4c81-8ad6-69e4c8f78f53", "comment": "Malware payload", "value": "9271e7290175220420f0767b10cda233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337011, "uuid": "d3897983-a783-48b5-8d87-2e2a970c255c", "comment": "Malware payload", "value": "a24de3c5856182867b469fb76452b38fdc68d00d61e2f4df79add9724ea03374", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337011, "uuid": "75c3f2f0-7833-461d-9529-34a7f37ddb75", "comment": "Malware payload", "value": "4bc5a2f5dd39ef5cd35dfc4986209d7997071637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337011, "uuid": "fccdcb72-d36e-4325-a05a-2b04caafa27a", "comment": "Malware payload", "value": "307a5b73632f59ad3ac2c28e05466fcea62ecf0d73e41ebe70bc5c4b552713f423a5f57e054a4df33de22c736264e906", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337011, "uuid": "8ef9ee55-ca6d-4829-b956-ef6b67b11004", "value": "T1BB532A11DF0C6826CD716AB595F72BA1B750B8D01034CE2177053B6F19B3A36AC8BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337011, "uuid": "00fc2f1d-a65c-44a8-b428-014938696542", "value": "1536:ctdrZoFv0pPmNVzDnTrl5AoF9BxcXWT0F+DUybRArOKTy:ctdov0grzB5XF9BxcXWT0oDUybQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786337011, "uuid": "3cf86ee3-2469-4a6e-b961-d9626e33787b", "value": 66616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786337011, "uuid": "c98bacc8-ccf3-4cc1-9f3b-ae0fc586bb56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337011, "uuid": "c791c771-4f93-4e42-9a42-75c2b3023856", "value": "a24de3c5856182867b469fb76452b38fdc68d00d61e2f4df79add9724ea03374.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9393101a-948c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786346691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346691, "uuid": "3cdd4253-e99e-4fac-a6b7-116aca0468d4", "comment": "Malware payload (Mirai)", "value": "65689c30da883dddf80de3a0f74fd3eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346691, "uuid": "b69ed5ef-3426-4636-9566-591dbf4b81f2", "comment": "Malware payload (Mirai)", "value": "a27aed9b008f416b6ca6ba938ea65189c60a02db446b7c4e622946d8076f3f4e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346691, "uuid": "d0f1f275-4bcf-476f-8e8e-cd7ffa439c0a", "comment": "Malware payload (Mirai)", "value": "910c94ed55f36b0305940e6c3ff7ef7f742e9aff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346691, "uuid": "c0034fbd-6bab-4871-a5ad-15b840a22a0b", "comment": "Malware payload (Mirai)", "value": "82a07e986c4b7021262f58123d4eb0d5b251fc1156d0d70458829c3377ed0f098a6b83dabdbf5d338f88fa0d8004eb65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346691, "uuid": "101ef8b3-3b1c-48b6-84e8-e36a5ff0d38f", "value": "T1EC01EFC5D0544D0040D9948D32E75194F831C3C719468B69FFACA47D9B94D08F0B6F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346691, "uuid": "28d50249-0ce0-496c-8fc3-510dab323bd6", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaakCQwFC7luCFR1KW6FCYKgV03CjX:kXCKysE2hi0ziQvZohaNGFWIfDFLiYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346691, "uuid": "134df1a7-e8f0-49c6-b591-e55fceda3282", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346691, "uuid": "e15dc6c0-3af0-45aa-8414-5d8c4fdce42f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346691, "uuid": "82b9db54-175b-41f5-b8c8-2837012fb78f", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42027e00-94f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786391652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391652, "uuid": "65c0897c-95df-4ab9-b617-a9701ae9b2fc", "comment": "Malware payload (Mirai)", "value": "ed4e306e7c110b04f95ca1b3e121dea0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391652, "uuid": "3e8b7138-d462-4698-9353-a02764f027e5", "comment": "Malware payload (Mirai)", "value": "a2860e91545e96e48064b57874ff3f04500832b2c5665f29b2557307bd3c5043", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391652, "uuid": "1398a50e-90eb-4352-86fd-1af7ed1899e3", "comment": "Malware payload (Mirai)", "value": "036a804e99dbd67c0f7a9f98221f0d138844c820", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391652, "uuid": "c1bac4cd-326d-48bb-8c96-80c205cd6158", "comment": "Malware payload (Mirai)", "value": "9b7c53c4bcd71f8b8d5109ae0acc60ed85ff02e422c0619bc1bfdcc7cf67cc27681b0a589b3fbcb9ef537fb353b1e56d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391652, "uuid": "93f4fb58-7e15-49c3-af4f-3bb63f565a90", "value": "T1C3158D9DE786E0E1F26300F1025ED7F75534A12A5053FAF2EF462663B8327A17F1621A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391652, "uuid": "602eaf03-57b5-40d7-ba01-e17f756f5403", "value": "24576:ML+8hPlhYhhEtVsF4eXmzLr16J4tkThUn5QC+n:ChYhhEt9eX+vehuQC+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391652, "uuid": "efbac0dd-a305-44fa-8225-35de9d3ed5d1", "value": 935800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391652, "uuid": "091d52ff-986c-4b36-a889-fc17ed7e0b13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391652, "uuid": "405d7cbc-4b67-47c0-900e-ad61a3cd7da1", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8889cf-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370647, "uuid": "048f6259-6a92-4815-aa45-c076ea03135f", "comment": "Malware payload (Vidar)", "value": "21b042dac622a80701cedef8a26e6e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370647, "uuid": "c101943e-937a-4068-9457-cbaaaa104cb4", "comment": "Malware payload (Vidar)", "value": "a2d140305b4938185e512df57bcbdf27897f53b734a798a3f5072a5b5a8a8966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370647, "uuid": "a21a8942-5f09-42e5-a069-4bb38f7dda3b", "comment": "Malware payload (Vidar)", "value": "4ec8a64857bc8014754c171934e08267b5992a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370647, "uuid": "77002c31-87e7-4f95-8137-239324968b3b", "comment": "Malware payload (Vidar)", "value": "3ad4ba2583a2b38af5e532eb7b9fb3ea83f001b206da83318c3db028c53648a5415f53fdf01249cd2a3e72b7beb2ad32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370647, "uuid": "386a8e46-9c11-4c2f-8c71-b5dc6fa252d8", "value": "T1A0925446E15B6AE4C4E9CB32A75A526352FCBC2421319B3B5FDCA63A0D42330F7542ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370647, "uuid": "519142d6-523b-45bc-9603-ebfd0e77d199", "value": "0fcdbe8dc380312e1e50301da9558e95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370647, "uuid": "fad791f2-194e-4424-8915-909a0c90ff70", "value": "384:O1KQYCwdlNGhbo+sQDV9/FndH3doF6nfqZb5EyZv1hZlOL:oLwq7s6Z3doAfqp5EyZvbzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370647, "uuid": "6c049e45-59b2-4baf-8e0f-27c1c9b37f9b", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370647, "uuid": "b2e67601-cb65-4afa-84c3-3fd68c91b938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370647, "uuid": "93e4aa50-289d-4cb6-9f7b-671c58df6566", "value": "a2d140305b4938185e512df57bcbdf27897f53b734a798a3f5072a5b5a8a8966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccad672-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374114, "uuid": "27929576-0871-45a2-8ca8-96848f7a1417", "comment": "Malware payload (AsyncRAT)", "value": "d62a82a6f9ea308d1d501e030c7a7d0f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374114, "uuid": "9a480f67-256b-4f15-b991-81ea8ce7558f", "comment": "Malware payload (AsyncRAT)", "value": "a2e3edef369522b73606dd440d30515f009c95355d6d580283c0a8e39b7637aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374114, "uuid": "3cf19311-ad55-465e-a695-a42e20d8fda5", "comment": "Malware payload (AsyncRAT)", "value": "7afdb35789b969d6d32562b81cbbf3a493f5bd94", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374114, "uuid": "5386705d-ecce-4af9-8de5-8c6c2a8cce76", "comment": "Malware payload (AsyncRAT)", "value": "b866b1deedc1c23620971130d6d3c49bd679c9437240db6a6a5f6e821d56a192c5d8683b6e0f711e57b55e3832a246f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374114, "uuid": "c53f79d3-ad5d-46ab-87da-328efe460d69", "value": "T19F1501886606DA03D99457B80A72E7B817BD2EE9A400E3175FDDBDEFB633B454C44243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374114, "uuid": "698e08f3-0628-4916-9512-63d659447258", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374114, "uuid": "d4ac655f-4b97-4385-a2f5-579249be5420", "value": "12288:FeR2d/9B6MbHMlYW/RiiiNlzcXj19AO/rsWbXx99gJiw6VG/a9ewY1gGeQU7:FeA9ssIZoNlcj7RbFgYo/a9W1gGeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374114, "uuid": "53c32904-96c5-4fee-b4e5-a62da1b63c78", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374114, "uuid": "619463ad-ab7e-4fbc-8173-e13fe99f72fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374114, "uuid": "0113b0f8-9f1b-441e-85d3-ae40fa6a7f78", "value": "a2e3edef369522b73606dd440d30515f009c95355d6d580283c0a8e39b7637aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832ff552-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372863, "uuid": "132ef8ed-acd7-401c-8ae9-96b872c8b3f4", "comment": "Malware payload", "value": "83ad45dce89fa3d8aa7d084d3a02285b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372863, "uuid": "96398342-447d-4643-96c4-87b43e1b5ec8", "comment": "Malware payload", "value": "a41530f363233911429d05cc0343ddb56527b994a31f4a26ba93340cd3feb629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372863, "uuid": "76e76b37-f4b4-4e7d-9188-d559b2aa4708", "comment": "Malware payload", "value": "92ef81aa2254622b653ae6128043b8e2ff0bde7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372863, "uuid": "8d226128-40a1-4786-ac93-6831e6c6b39e", "comment": "Malware payload", "value": "671b773a322091f8ab61e5a4dab553e18a64bd2a6385071d55f90a484806c602d3981cc2ce0f1fc672cabd39a2833a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372863, "uuid": "800cc3c9-3381-4e66-a6b9-bacd297b5bfd", "value": "T1CC75229074D4D5A3E0E97239DBB1C1FAD7327CA8673452AB26027F9B3B326874635306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372863, "uuid": "55b2b3f1-deaa-4ee7-824a-64509c1436e1", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372863, "uuid": "fd4031dc-0a40-41c7-a59c-7c066ea38deb", "value": "24576:4BZT5rmAsfaqJUQGYveA9MBoJGNY1lgiZpjY6bAq/iel3Y87iOsx:kZTkAgJUqf9HJ31Wuj1K87iN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372863, "uuid": "6da14247-00a7-430f-ae37-13aa5c967a3c", "value": 1702400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372863, "uuid": "19c1d1e4-6b07-478b-8a0c-451dce1088dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372863, "uuid": "0735c0dd-e568-4a20-b42f-07f82b408c37", "value": "a41530f363233911429d05cc0343ddb56527b994a31f4a26ba93340cd3feb629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bce8cd5-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368985, "uuid": "1f416844-3f60-4c6c-b944-f4bbab82a7a5", "comment": "Malware payload (Vidar)", "value": "46d0e9c6eb7e81cccc864bf02b4b30e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368985, "uuid": "bd7dcd3f-3856-4a1b-b8b2-b9c45a7f6460", "comment": "Malware payload (Vidar)", "value": "a437cd6a7e97fa34058c3172e30e3fb6ce4264a6695f57086934e6b1d2624293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368985, "uuid": "94873086-7cbb-44e9-9e68-213bfd536fe4", "comment": "Malware payload (Vidar)", "value": "0726d678fdfc9089feca06a2d6064b1008345fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368985, "uuid": "da22cb2e-a7f0-4ff1-b081-dd234a60eacd", "comment": "Malware payload (Vidar)", "value": "c7554413d30ec978367ede6e683349da37c7d1a376b4f6c6720867998b2fa3a45e6bdc20e4e274561bc0eb50b3576fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368985, "uuid": "e18447c8-404c-46da-90db-60d5e8d087b8", "value": "T128422A8A72D2F0FCC1A4C2B5B5EB15E28E263041139665FF33B5948167D3116B23AF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368985, "uuid": "e3ae25bb-161a-49c7-b1b4-d4dda078fca7", "value": "de4da189dce4a2df3103d8e87a228861", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368985, "uuid": "5f5d614d-c8b1-4d28-bb42-74fa4e9247ce", "value": "192:OqgUReGPTb9kh2NVNWQONaARxHIdvmyB7CeRPKkiH3op9Y7E48A3VGDHS:OPuLvKQeQOL2vPUkgg9YlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368985, "uuid": "6024d887-d7cc-4846-96bc-6308d087be97", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368985, "uuid": "5e408e14-a821-4e71-8384-359dfa20f57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368985, "uuid": "2e1e0ff9-8916-4d83-812f-7bad144e03d5", "value": "a437cd6a7e97fa34058c3172e30e3fb6ce4264a6695f57086934e6b1d2624293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2c4b1e-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369016, "uuid": "195ee61b-c1e0-47c9-8f13-7a050cfdc37c", "comment": "Malware payload (Vidar)", "value": "04471402532b1337237f86d9261c940d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369016, "uuid": "0abc0f1e-6285-4d24-8855-a39ac8cf407d", "comment": "Malware payload (Vidar)", "value": "a473757851e121caa21492de8f8aed7f6cb104cc7fc2435deb6aca6f6e628412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369016, "uuid": "12902e20-b0d6-447c-982b-3bdfb1c633b2", "comment": "Malware payload (Vidar)", "value": "5765a625037ebc866ea9ea7eae0ca36da20f1c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369016, "uuid": "7a27c7a0-635c-4517-a7c0-9be56f964fbd", "comment": "Malware payload (Vidar)", "value": "5f0864e1b6f487775c12a198d919366ed79c034a5ee45a5b855e4e0040706b9a9b543cf67584c5bcb42f6386ffddb04b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369016, "uuid": "3a830cda-9cab-428c-9ad7-520fd024aca9", "value": "T1E1424AC9B5E6E1F8D4F4C670A96751BBEB25300013425EFF73AD54541FC2A24B67C48A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369016, "uuid": "163cdb98-d196-4bc3-816a-8438d9fe59ab", "value": "cf07cb97e4ee7855ab9adf42130a0267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369016, "uuid": "22cd3ed3-9c33-40ab-a20a-80777ca69a3a", "value": "384:OphroPgX2q3LHwL/o7TIEtH6SyyVTIm/dl:ihroPgf4Cl66/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369016, "uuid": "adeec2ec-a9cb-4181-8349-70e9a2300dc2", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369016, "uuid": "fde06eef-e4ae-4ce7-bd58-ec6109542b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369016, "uuid": "246a6ec3-2f9c-4948-b0de-5a026ae64878", "value": "a473757851e121caa21492de8f8aed7f6cb104cc7fc2435deb6aca6f6e628412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b868d7d6-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368228, "uuid": "f75f8bcb-86c9-477f-8597-433df0b9cc76", "comment": "Malware payload (Vidar)", "value": "bd66f76cd7674da24574f533b9e12030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368228, "uuid": "2043df03-9870-4756-a9f0-4dfa632b4922", "comment": "Malware payload (Vidar)", "value": "a49fa7df637819ee532111312a14962f7ad96a82e449489c2927d24a3c8fc53f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368228, "uuid": "89f7474a-beac-46c1-a27f-7d234d80d267", "comment": "Malware payload (Vidar)", "value": "ed8767aba7683ade9e60305498101aa6d93cb3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368228, "uuid": "cf79e821-6deb-4a04-bdb1-b5f42f791fbb", "comment": "Malware payload (Vidar)", "value": "55f7637687085ab074d18da13496fbc3f0f4bfc91e4ec1e3211be6d007fb78dcebd26c0ae1984ba22ea788515f0c7dd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368228, "uuid": "16fed568-925a-4dac-89c6-a6f92a9ec44d", "value": "T151520ADA72E760FDC1A6C278CB6A0977D7293086171E1FBF45EC82843BD1A107978E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368228, "uuid": "d39523df-6c57-450e-befc-af3591667b0c", "value": "85b0aeb0d13fb5c7226c80e10830c4fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368228, "uuid": "516b9dd1-4f2a-4fe6-ba9e-3fcf50bdd068", "value": "192:yDi9s/bWLVK186o6pJXXuL2O6ExI16KF39ehKrZaOU3VwuIJc0Ib5D:yDMsDIVK1k0XW2OQ6KFt0SZilwrJcl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368228, "uuid": "c10742ba-27fe-4793-9516-09af9f12d88b", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368228, "uuid": "5251c05d-5230-467c-ba25-7b16898b6c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368228, "uuid": "1a5eee6d-8bec-42d0-bb41-04db2cce516e", "value": "a49fa7df637819ee532111312a14962f7ad96a82e449489c2927d24a3c8fc53f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbbbf01-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369441, "uuid": "c94a864c-4d48-49ca-86cc-68b8f26ee6e4", "comment": "Malware payload (Formbook)", "value": "4d2e68d1e796f7592eb9a788c859f882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369441, "uuid": "0d33166c-f27c-471e-b2ba-eefed67582e6", "comment": "Malware payload (Formbook)", "value": "a4b0a84db7be828a5594158ae91e1f5bf4a80972042e5ee9718b40a5d64c52b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369441, "uuid": "0832aa53-ff79-4bc6-9cb9-8ca7c3dbf383", "comment": "Malware payload (Formbook)", "value": "de99d3549df6461960fb2e62e4d2ef7b79b43381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369441, "uuid": "e75b8f06-3bbf-41cb-8acf-c854f1a048ec", "comment": "Malware payload (Formbook)", "value": "df0eaa2b2c58dd9d03a1050a3f3887a27fbcce61d6f654f45a719e1da924243f7127985284d49e8e4478f8b1e7163d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369441, "uuid": "5ab3eaca-c133-4531-9d05-f174bd2c6cde", "value": "T1433501486B4CC806C45157388CA1E2F816696E6DFA11D253AFECFFEFB9727124C91392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369441, "uuid": "d5cdb3c0-1bee-4127-8b86-883e508e94d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369441, "uuid": "bdcac972-62f1-4cef-b176-2bb2bccb0216", "value": "24576:wAvV0LonRn9qaq7y2kzaDR/6pmQ8COwvMf0V+iuZQ+6CGjQQy:wAN0Lo7qaq7fkuDR/A8oIYUZQZpfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369441, "uuid": "699cb913-fc90-4435-b0e3-45f054ea4ec8", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369441, "uuid": "67aec46b-9ed1-421d-9bda-83cc58cf3294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369441, "uuid": "2b524993-e89a-46c5-938c-4e7073c2d191", "value": "a4b0a84db7be828a5594158ae91e1f5bf4a80972042e5ee9718b40a5d64c52b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46968f3-94b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786366154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366154, "uuid": "41b12a58-a25f-41bd-a352-bdae5ae900ce", "comment": "Malware payload (RemcosRAT)", "value": "ebdcba267a02d8ac1093dfae07bae88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366154, "uuid": "c8d1c793-20db-46f6-acf0-4c7b6100f9eb", "comment": "Malware payload (RemcosRAT)", "value": "a4c6bcde72216f0168d6356410960d9cb0f648e31fd9ead093f32119e4157cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366154, "uuid": "f159caf8-4d52-4c1d-b988-ec822f5742cd", "comment": "Malware payload (RemcosRAT)", "value": "09200d11d599e5eeb2784391e3c862ca099b4e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366154, "uuid": "86df83ae-b748-4e39-a62a-f1fdc571c4c0", "comment": "Malware payload (RemcosRAT)", "value": "866ca3ff45d096eb2b01090cec21e571483eb2918bd0b06bb7c4937242a8de04aa840611be441ad0f58d8dce5e1b4879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366154, "uuid": "c95ae96b-616d-4958-96e4-676e62049dd4", "value": "T11525B0B976046DE6E67F437FC997ACEC13B639129A8B98CD80A477C30963371ED12805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366154, "uuid": "4ce9e673-f9c8-4653-96c7-9c2c2f1e0acc", "value": "4dc9ab2bfe24b4f36c1c05073a4e4a56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366154, "uuid": "8491e0b2-fd04-4ab4-9c97-c0b8442a7def", "value": "24576:/Xfhd9PkH+I7ChYvXn0veX3D+hCrDqhEqELzR:/XfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366154, "uuid": "55096dc1-4bd3-4285-b660-b2e1048fc073", "value": 987114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366154, "uuid": "7622a4d1-d7e4-4d50-9a7f-ba85d63a9feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366154, "uuid": "5055a27b-17e7-4e6b-87d1-296d644fa69d", "value": "winhttp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8494e7fc-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368570, "uuid": "bde5f6f7-7c1a-4e33-b6c5-ec0ad746f0c6", "comment": "Malware payload", "value": "a7b558c8b3cf27daf84eaeccc397f5c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368570, "uuid": "54952378-ef7d-4fd4-8b51-a10f3d437e84", "comment": "Malware payload", "value": "a4e1971f3670bbf54a7207545218ac1e1689b21f7c0c73e2b61d8d3ac28edb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368570, "uuid": "42140be9-efb7-4ee5-abaa-c9a5e8386211", "comment": "Malware payload", "value": "d813aba4a2af6c3507691d305f3057c5ac2dd619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368570, "uuid": "a85e0d54-674b-4ec2-b641-b9e1f3f3e5b9", "comment": "Malware payload", "value": "bd034b928b38d55b5ec9f54c17f10ecc16f1774fc121fbcbc93341e10dab5b092e33956418530bf50cc7b1060932a147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368570, "uuid": "86846056-7e87-488e-9565-c8fedc740816", "value": "T1A1E4C0165D423B95EABE1F7DC0A20858B3F4D913D396E79B6FFC40F489A3B80C91A512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368570, "uuid": "cbdea375-aa99-4225-9ceb-107ce00cda72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368570, "uuid": "dfe19532-270b-4660-a69e-c987714b6702", "value": "12288:4+l2Dllm2A83T3wkTMLsu7SuGHIqAGG/lL:WllA83Tge0F7UHx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368570, "uuid": "5a26d57e-41b8-46c2-ae0c-2301197347aa", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368570, "uuid": "74e081c1-41e8-4b8b-bd07-091e3177a1f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368570, "uuid": "4b692183-dbdc-42d3-b053-5469757eb24b", "value": "a4e1971f3670bbf54a7207545218ac1e1689b21f7c0c73e2b61d8d3ac28edb8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f18578-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372468, "uuid": "572f2fa0-5835-43dc-a210-c4cb5a936f91", "comment": "Malware payload (Formbook)", "value": "087963d1a513e676ea77d5c6947b25b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372468, "uuid": "db601479-b45b-419a-8805-6a28c88639b6", "comment": "Malware payload (Formbook)", "value": "a62e87cd34cf7d2a62da54f2f75c9b5833960f14e0831831d01fb2fa53293c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372468, "uuid": "ea4d70d7-5e90-41ff-8bdf-83ac54edc65e", "comment": "Malware payload (Formbook)", "value": "dc3d4373652a7493092e11468d7bdfbf5482dacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372468, "uuid": "a42fad27-f8c2-4b12-bd44-4eaa57b6abfa", "comment": "Malware payload (Formbook)", "value": "3fc773f82dcb53724d78e7d3e59409c0bef8549a991a8fa0c25b50febd93829bd1c6896df41c4dffbd82966004644f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372468, "uuid": "66678f93-c113-46b3-9223-7cb8560fa036", "value": "T11C351224A6BBDD01D2798B71C8F2D0B003B06E4DE922C24B9ED97DD73A717861AC5763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372468, "uuid": "6b2c55dc-a6e0-4ce6-87d4-278cdf239a78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372468, "uuid": "f2355373-e9c9-4cb2-baa6-ad450b8401e9", "value": "24576:Lj/Og3+6nIIhdtFQhUHBH+j15ElYHsk7ZJmG9Ae5ByJgqn:fPO6IKJPBblYMamgAejyJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372468, "uuid": "f11a458a-440d-4a9c-aea7-096a0d806c1d", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372468, "uuid": "e70938b6-7f85-48a9-9138-a8a0b4452d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372468, "uuid": "df3300f9-2d0b-4cf9-a264-1cfcfa7b32c8", "value": "a62e87cd34cf7d2a62da54f2f75c9b5833960f14e0831831d01fb2fa53293c5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7345a103-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340195, "uuid": "d50d3972-ed8b-4dd7-88ac-ae96ee53a8d8", "comment": "Malware payload (Mirai)", "value": "a084f4b235a1efc7b8c282ad9eeb7d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340195, "uuid": "6f55eea5-4138-4ac4-81cd-f8947ca69649", "comment": "Malware payload (Mirai)", "value": "a662880a6e26a4b2a33a344f05008538e6e797c34c8c2e33234404ae0366e614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340195, "uuid": "ef8ca199-d67e-45df-89d7-6aeef1471e53", "comment": "Malware payload (Mirai)", "value": "19e841568eebfc74e9ca88ef898240075abc61f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340195, "uuid": "a49c3d9d-3a3e-4a4e-a927-b89174404056", "comment": "Malware payload (Mirai)", "value": "eab4b35611d0f4cbc94b11049ac46b0cc395bee65410da9df49814fa46324f113f7ece25c99b8815af14ae2e43c0a028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340195, "uuid": "585d3a6e-571e-4b35-a762-0a686de2f907", "value": "T15A74FC8CB5F2E2CAD1D4EAB5B319784D37530736B1D73146A51EDA3322EF19809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340195, "uuid": "377f0b0a-1748-43d2-a8ae-8ef7fe94663d", "value": "6144:sfoa9Xa93a96f61QokTEsQy9/PjEqi+B3rLNJ0j3G:5a9Xa93a96f61mEsFprL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340195, "uuid": "77a55f48-68fe-40ba-84f1-7ce3286ebb95", "value": 370344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340195, "uuid": "b1b606ce-b8c5-4b9a-8a17-e13ddd6830bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340195, "uuid": "452ee65c-43bd-4fc7-bda4-059d1b9f2fe3", "value": "pid.ar5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92425d97-94aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786359574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359574, "uuid": "43032263-54ab-4859-87be-2c344ce0fcd0", "comment": "Malware payload (Formbook)", "value": "893cf55eb5c958896580854b7f5c44e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359574, "uuid": "0ebbfe81-e68b-4402-9a77-02e504f3e7cd", "comment": "Malware payload (Formbook)", "value": "a6a6674d13230442f10b0b6663a5e659f9d3a072b8e575fd332baa5ff685a1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359574, "uuid": "a1b02e5e-7f2f-4dc6-ba57-65233be4c18d", "comment": "Malware payload (Formbook)", "value": "0c20fb53da56369ffb8c90706b8d1c05e76fc3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359574, "uuid": "ac27e2a0-a6c6-4407-b281-f0e5a2a090ba", "comment": "Malware payload (Formbook)", "value": "0c71af7ea18d6f9c883f886dd1437e05ee7d30864a7c13db6305037703d3c6907fddebe3a9c1601c920a7849041f260a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359574, "uuid": "5ccc4147-6e04-4e6f-94a5-7e5a8fd6e66b", "value": "T1E23502493269D906C4935FB04A71D7B44AB81E88B961D303DFFABCEBB86A74138543D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359574, "uuid": "91191e1d-8e24-493a-adde-22ddf8d28307", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359574, "uuid": "35219f04-f493-4fa6-bd66-20c76552863a", "value": "12288:DFqAGIx2zCVTDEAtL7DyLEYuD2KPAX0X0XjLVgmCTTQqNgGCxY8uSGwFTcj977nW:DgI4CJDr7Dae2KRsX7sMmTaFTg5nBVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786359574, "uuid": "59bffd02-3df0-4140-83ae-1dbb6a8ae435", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786359574, "uuid": "1f100193-3d58-429d-9ade-f3acaba054bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359574, "uuid": "07ee0a01-0466-40b2-978d-12a03d85e82d", "value": "xz2KaoDtJ7WVTKl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3bff60-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786374219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374219, "uuid": "602dc1a1-548c-438c-b870-cb6c4604ca27", "comment": "Malware payload (GuLoader)", "value": "ef0f924151f234c344bc8b995c24602e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374219, "uuid": "155939aa-9407-4a9e-a50c-1d5a6f6f7523", "comment": "Malware payload (GuLoader)", "value": "a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374219, "uuid": "a3ab732b-0cb8-4cef-acd3-b94081a75179", "comment": "Malware payload (GuLoader)", "value": "1ac2bbb4f2c3c8135e85bb681da577001c71bfe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374219, "uuid": "1cba63ad-a2d6-4726-84d0-7e625eb374d0", "comment": "Malware payload (GuLoader)", "value": "a16cb8fd6b2f8ba49df64062d1bed51c5e61bdf534533ca41358762efb93e96c3b7e894077d5784059609275cbcbb5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374219, "uuid": "d3adb151-68a3-4298-a44c-1c3b7d9eb5fd", "value": "T1E5849C67FA53C0EBCF7813F2F5D3E5BB1DFD68566C94909A67E29A927000E321A0D124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374219, "uuid": "a85d20a5-cb2f-4e95-bfea-5b3ed2fbf367", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374219, "uuid": "d1c2c727-6d4f-4aea-bc33-23828affe90d", "value": "6144:Pz20GHu6JDLDQSP4v95xtTyxYjFK3/Xr0attVfHNTvJ1UDN:KDHVPWtlKhRFvoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374219, "uuid": "f0db3bce-f5d9-4423-944a-de5c404d57fc", "value": 373280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374219, "uuid": "0bc90b4f-191a-4c47-82e4-629cc9d413a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374219, "uuid": "329b68af-84a0-4706-9a3b-95612513e671", "value": "a6a86646b0066a630d7e6004ce08d52e70d81e77d98268b98a34b588cacded0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc2fe2a-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786397011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397011, "uuid": "d80f92de-0ff0-4b6e-8b91-4cb244b1e07b", "comment": "Malware payload (Mirai)", "value": "eb2288b7c188963c228ec4fbb7d4ebbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397011, "uuid": "009d307b-8a04-44c0-9464-716a89ee991a", "comment": "Malware payload (Mirai)", "value": "a6a9d179d50a8102d277da718045535cf59dc5e7f48420403ac34c2f08fb5e35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397011, "uuid": "73ccd71e-c42b-46f0-8aa3-01ecdc051612", "comment": "Malware payload (Mirai)", "value": "28053cd15f646eb8c7ae97d6ec4e28d0c542bbdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397011, "uuid": "dee46e61-5a0f-4f51-90ca-d58bdf5bbbcc", "comment": "Malware payload (Mirai)", "value": "074a5fe14c52a291d0b4dfeb5d81d9beb6b6ff9136d81757ceafd0a523097f42dadae84712b66542be97186fcd8bdd69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397011, "uuid": "1e0ae4a2-e12f-4ce7-850a-c9a9c9ab511b", "value": "T1A1B43955F880DF61C6D135B6F64D42A873070BB9D3EB72069A245B343BEB86B0F3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397011, "uuid": "9b1e178b-e1a6-4d28-a3be-c3f894d14786", "value": "12288:+xfuf9/6hBS0XqbCLThPDmhKXCiEhi8pLgTbS:+4f9/oFThSifX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397011, "uuid": "ecbe37a2-d76c-43ba-ab35-e326524d8e8d", "value": 534876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397011, "uuid": "8b6f11ab-93dc-40ef-8a05-1ad94a28c92d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397011, "uuid": "6d688f37-187c-403b-b7db-562112e3d031", "value": "slim.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba923ec-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371616, "uuid": "2b89ef26-ec2c-4959-80f2-30a0233f738d", "comment": "Malware payload (Formbook)", "value": "790849138c8573608463a19378317129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371616, "uuid": "1991e78d-0552-4be7-a486-207dae2a4b6f", "comment": "Malware payload (Formbook)", "value": "a72383ca76618c118a31b6867a93d2afb1aace5e3cf090d9420e42f96baf5314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371616, "uuid": "6a753a32-9c48-4fa2-9bef-2104d30f1625", "comment": "Malware payload (Formbook)", "value": "9793147c7c6d54ecf59a2206ccdff7211a1e8b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371616, "uuid": "41068fbb-ef3b-4597-877d-cb48684b34d3", "comment": "Malware payload (Formbook)", "value": "5ca3da87c5b10aba3f464026232b9c40d7e021f29f5d6e73ea2ecefd52ec384a68cf72997365c39f2e6859af33af0746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371616, "uuid": "aac59c78-f94e-4000-9eb9-80f3762b0bb7", "value": "T143251248EB15F606C91557B40E72F3B523ADBDEAA011D323DFDC6ECBBE66A180C50291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371616, "uuid": "b5a9860a-9e75-48eb-9c0c-f1bd7982c215", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371616, "uuid": "a3a7f8ca-dd19-45cd-af6b-312968ee8a93", "value": "24576:mMcP4qiwG0C/pFtyoKBK2oPxLKNiC4CrqWobkTfZd3HTnNuKhP0:mMOlib/tyoIYxI4Crqifb3HrNfR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371616, "uuid": "6da6c69a-e2b1-4c82-86da-efd3d2d93302", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371616, "uuid": "668c5df2-02d3-432f-868b-826c8a4324c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371616, "uuid": "b6ed789c-24d1-406d-b0b4-c0ab5f3eba86", "value": "a72383ca76618c118a31b6867a93d2afb1aace5e3cf090d9420e42f96baf5314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a135cd1c-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371195, "uuid": "54dc8d6c-018a-4751-a847-32862c727274", "comment": "Malware payload (Vidar)", "value": "21cbc8ca41cfd895ebae07f0f84836b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371195, "uuid": "535491d5-79cc-434f-ad58-785c275dcbdc", "comment": "Malware payload (Vidar)", "value": "a74dee65dcab958b74721203cf4297a7b08a50ce78b391288bd4062ac9c7cae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371195, "uuid": "60278974-60e6-4f4e-a5e0-ec4b1fbd18f2", "comment": "Malware payload (Vidar)", "value": "911732db50e6c553d1e2309a9061a11ee48f5161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371195, "uuid": "dbefafe2-a785-442e-b066-34c40083c0f8", "comment": "Malware payload (Vidar)", "value": "b75cf48d277414ee9a08ba9e1e9cc9166fcf5fdc69bc550c2f2726da8174ffb4993550176206586a1b068dc4205e1e71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371195, "uuid": "89f3303a-d269-4d79-9266-5a67aafd6bb1", "value": "T198724046E20B62B4C4EBD733671A51266AF9BC052272A7379FDC56311D92330EB182ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371195, "uuid": "ab91cbcd-55f6-4808-92e3-42e920a2d145", "value": "26d19d8b256971ee26a63a1573b9706b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371195, "uuid": "1aa14787-581b-497a-9886-79e114dbcab7", "value": "384:OL4x2boH9dfcoRncoe4fI9Nug0qrf0c+vil:Lx2Sb5cRZBrfR+vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371195, "uuid": "fda9b6d7-89ba-4cb2-aa23-a6537d8f9661", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371195, "uuid": "e7523abd-e3a0-4a67-9355-59fd7e7c889c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371195, "uuid": "86465373-e018-4515-aa8e-c15684a170d3", "value": "a74dee65dcab958b74721203cf4297a7b08a50ce78b391288bd4062ac9c7cae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04db554a-94f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786391549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391549, "uuid": "7066ced8-9ae7-40d0-8b5b-d031fb46d76d", "comment": "Malware payload (Efimer)", "value": "de8ef00e7585e378084487873407c40e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391549, "uuid": "e71b2dd1-7d20-4774-9c39-0a305122b95a", "comment": "Malware payload (Efimer)", "value": "a7f980ae03ad3be821209184e1415301c06f5263b7fcfce59032fab0321b87d1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391549, "uuid": "357c0007-9915-4992-88da-280a9e5fbcf7", "comment": "Malware payload (Efimer)", "value": "667c319961c576e850f74d19045b8bc9bcd24257", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391549, "uuid": "028466ea-f91f-47dc-8a91-9be7b00bcf2c", "comment": "Malware payload (Efimer)", "value": "06c370e7144a38a3831f035800bc17ac978a6e5220e5f2ebb9046ab3c045040e8f6d44f3e1b8017245bd7ed553e53447", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391549, "uuid": "90e29781-57ca-4846-8743-1e95bb3befb7", "value": "T1DAE6334829E420FEDD738278EAC50A95E674B8661B31C6EB47B846817F970F45C3E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391549, "uuid": "321bb0f7-b6f0-412d-9480-d068b77bb431", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391549, "uuid": "acbb06e3-1f52-4959-b41a-e04b73d92ea2", "value": "393216:uZJmacuasb/uXHKXJiSmmXMCHWUjnGcuI3/PGTAI:uZoS/uaXpmmXMb8n7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391549, "uuid": "cb3888a5-3622-49ae-aaef-c0f3eb849357", "value": 14020614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391549, "uuid": "c3231298-336c-4455-bad3-562d33d0352a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391549, "uuid": "e240e58c-e433-43fc-8a13-ae0e8d4ebd71", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811b3a1c-9462-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328621, "uuid": "10ded31e-bf20-4035-aad8-0d2a467d5075", "comment": "Malware payload (Mirai)", "value": "1e4ba8e2cd5baeff395d6c45992b26e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328621, "uuid": "ab33cf99-2238-449a-93cc-319436342e15", "comment": "Malware payload (Mirai)", "value": "a85a4f1cb021269231f526880c990dc93db657e3173075fa12744b4f9ea4e9ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328621, "uuid": "b94a3573-8801-4eaa-a112-de665be43844", "comment": "Malware payload (Mirai)", "value": "bbca5011b7755a7748876f2354d9438c5757915e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328621, "uuid": "e0114416-48bb-4cfb-8796-bea2e4e78672", "comment": "Malware payload (Mirai)", "value": "5f23c2f1e14a22bbf0c0e3978dac8de4d4c80addc084f79c5aabf63deceea6182d20c4afbba52cccd3ddf421157b00f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328621, "uuid": "32427e9a-33d7-4d60-a321-241cb2008628", "value": "T19CE2E1B067C2FE71C1F01C36E97AC9C6E3251B74818762E261FCD23EB2D610556B934A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328621, "uuid": "86265021-f3d7-4534-b3db-3906380861f6", "value": "384:0JWpYc6x6cv4bkusuu81mm/fDQS07qI79jLKCFpy/IH9ILn9TVC9oONTjzvKHzCJ:aAYLpv4bhLGm10P9jhq/IHWRfONX3UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328621, "uuid": "1645b1b6-068f-4e21-8b7f-0e810d9473f1", "value": 31896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328621, "uuid": "a17430b2-abab-482d-a20d-d539950543ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328621, "uuid": "60809134-b36d-4235-a66e-3bd98dda0bfb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d57952-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369104, "uuid": "780be5ec-924e-4421-bb08-93f8ca4cc290", "comment": "Malware payload (Vidar)", "value": "f60f9badeda02d7fa8f696ac2d2e2c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369104, "uuid": "88ed9a3c-5bf6-43b7-b1b6-867f1febf19a", "comment": "Malware payload (Vidar)", "value": "a864ece8b4940b05c524c906b3c330018aec19d3b207bc7814df64e0780c1258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369104, "uuid": "f0f1cdc1-fa67-4251-ae6d-af460afd906a", "comment": "Malware payload (Vidar)", "value": "caf39fd39e097b3790c6f5bd3d8273fbf297c035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369104, "uuid": "4451a891-1815-4bcb-b01a-56c73647ed1d", "comment": "Malware payload (Vidar)", "value": "6e2a399dbab359af85daed7c7651f51c13476412c47a98667447f55e97bf81a24ea4c008f98a17e88d04e52152796f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369104, "uuid": "db933888-44f3-4f38-8f2c-fc98dde12e49", "value": "T1C0423B83BAE0D5FCD2EA8339A5BB24B2542234401723D5BF778785552BC3312B179978", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369104, "uuid": "c873fa4b-bc44-468e-acbe-0c651eaafa91", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369104, "uuid": "a75f6989-c8db-483d-a2b7-7bda1d930372", "value": "192:YxVCcl7STLrCCsbhDRw8IDbr+3fn+IG4thyieYmlN2Ha5/PBshgCvLEU73VwhxO:3clGT6C780W35dthInlUHa5/53YLEU7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369104, "uuid": "d87bfa05-5b8d-428f-bb54-a551542692d3", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369104, "uuid": "6c034cc7-5510-4191-9702-fe967b785959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369104, "uuid": "d941e900-9438-48cd-a5dc-dc6bfe520de6", "value": "a864ece8b4940b05c524c906b3c330018aec19d3b207bc7814df64e0780c1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07e9a82-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339922, "uuid": "8ec9d597-f03a-40b4-ba44-086d21fcad56", "comment": "Malware payload (Mirai)", "value": "f806b1a3e3a9342af8c21cdb9ff1e9ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339922, "uuid": "bbf2afd0-a68a-44f6-b928-8e7859244ac5", "comment": "Malware payload (Mirai)", "value": "a87fab6d9c30210aa164ebb6bc039b1457b1f6cca0a4b878137ed5e0cb3cd2c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339922, "uuid": "d5106817-fcac-40c7-90d3-bc809b63cd3b", "comment": "Malware payload (Mirai)", "value": "c080f85deeeaa064b9ae022cb83fe699afc04824", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339922, "uuid": "b2f09a77-17b2-4a78-bbcb-3649799032e8", "comment": "Malware payload (Mirai)", "value": "01ee2272d50f277aa575c1a64fa741e3aac6ddbbaa897a9d41155e46232c106a1a2829effe025d8cac980ab39fb748cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339922, "uuid": "2fc71b81-605f-43e6-bdfd-4a4aabd3dd9d", "value": "T1D5846D8861F5F3DEE2C8F97953057C169872293630A3B295310FA6B753A72540AFEE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339922, "uuid": "f7d485b8-6be8-485e-94b0-9ffc6e7799d5", "value": "6144:ba92a9va9ga3yNH3m7GmMnHgJQmCNNUxKeZql0:ba92a9va9gaQnfmQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339922, "uuid": "685a5a18-4c78-452f-9b90-0c0ff28a870c", "value": 372616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339922, "uuid": "39dc3f40-80d7-4bb4-b84f-a6069baa93a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339922, "uuid": "c4854dda-d580-4c9a-811a-542ba57a4020", "value": "pid.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b1afba-9496-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786351121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351121, "uuid": "1bf2eb6f-0127-4c05-9546-332d08641f83", "comment": "Malware payload", "value": "9927f2805f8632a45b3f9672daeb9de5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351121, "uuid": "c27751c0-ccc3-4035-a5ab-9a75b09121c3", "comment": "Malware payload", "value": "a90cca696e960b2e14025543fb4fe0992073dab4f1afedf45e3bd1a5c8e3ae68", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351121, "uuid": "4aeeb757-49a9-4021-ac9d-3ae704427969", "comment": "Malware payload", "value": "572da16e23704f460c039132db0d3caf7bb50e0b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351121, "uuid": "277d05f2-c511-468c-a43d-f0debdb2c8ad", "comment": "Malware payload", "value": "2087f5fc72be6b3d0f6875e4fc72c5167e3351101839782cd4b255cdaa7c4ee45474ef11829ea281d72bb73126f0d845", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351121, "uuid": "bf3efc83-412f-4b4a-bbaa-4a6cac29bc08", "value": "T129236C551A857C149A99C4371D7E2F0CBDAD43E6320452DE7FCB3CF28C8AA9D920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351121, "uuid": "ef41b222-6f66-48c6-98f2-a34cefc4b79a", "value": "768:JVEJVIhtMY9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:nEJ2MFcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786351121, "uuid": "ad9b80a2-b972-4290-b7bb-64a9398419b5", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786351121, "uuid": "b5433fd1-b637-47be-ad98-5835592f9ac6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351121, "uuid": "dabe0611-d9dc-43f0-9d18-f6ccc1483648", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0d3406-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395321, "uuid": "a7359313-9881-42f5-820c-90bfe4bcb163", "comment": "Malware payload", "value": "f7d92fff3e9843ae59290e5f4f95db31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395321, "uuid": "bc18c2cc-b9b8-479d-b7b1-90ef3f36f141", "comment": "Malware payload", "value": "a9226c9a03d9aa92f21d2589ad6aa9daed0fad6f91d38b82b85d7d26c135d671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395321, "uuid": "ea438aef-05c3-409b-bdb4-ec7f249e1f32", "comment": "Malware payload", "value": "565dec3ee617a79cf08e2c1f19545a88e4874c1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395321, "uuid": "717e42fa-cc18-47cb-9aca-34fec82cb850", "comment": "Malware payload", "value": "0e0d2b4ef231a89414c8ac5cdde87e487405b69d4e2847e96fa994cdab14e7064776d3c3c071b0afa4e92ad729cc2547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395321, "uuid": "ed680122-5aa0-4458-82fd-1ffc25951b2f", "value": "T152A31A2B358593F0F5411BB077EBA3E37C650BBF1466A0AB5B12261966F0B7B603C847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395321, "uuid": "0435a449-bcf4-4068-9135-771bed66be64", "value": "3072:ttaIDt4nJRLeHuDuVf47bKg7tNC3b6KheQoU7U8:gnzSuDuVc7tNC1eZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395321, "uuid": "8f8849e5-21df-4cd3-87c9-c709626c7971", "value": 99104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395321, "uuid": "d19ec8e4-50c0-445a-a74a-f4d2d0d467a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395321, "uuid": "0cd1dd96-4f70-422b-a5a5-063d0f369259", "value": "main.openrisc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53108c6e-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373212, "uuid": "a3127530-6f32-4b4a-b061-c987515aafdb", "comment": "Malware payload (RemcosRAT)", "value": "6a10e9fd9ee5169b0c2d6540cbf47a31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373212, "uuid": "4fc78e11-8d7b-4de9-9e58-2fff0a36fdb5", "comment": "Malware payload (RemcosRAT)", "value": "a923cf298231c277fcf855d7d4dc0fcf526028ca13dfee893f73ce801e142563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373212, "uuid": "5925e566-21d6-434d-bd68-b76ad8cba7c4", "comment": "Malware payload (RemcosRAT)", "value": "2190e6fb05be2579fcd3a3155fa71c43a2cc2e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373212, "uuid": "c7dabf27-3e35-42dd-87d9-0eef86e5960e", "comment": "Malware payload (RemcosRAT)", "value": "716c0f1f951afeca350b9081e5ec774321999b2a656a58d296d07d0b7e7b560dda6ba611d569ec0e0fbf4bd0a39ac81a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373212, "uuid": "d817f183-f080-4fb9-ac4b-3ed64a625169", "value": "T156152317A158C253DB0A1BF82031E374A7BD6DDEB420D28ACFD87C97F63AB0A5950257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373212, "uuid": "6a5d40f3-c7fb-4981-be89-e7bd3b74fdcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373212, "uuid": "174b88d7-125d-4e3f-a134-a57f2af2c205", "value": "24576:AHBYg+gJywDQv5P4agZ1HRl444dUXHi+vFHBYkHBY:EaLsQxP4a8ZRa4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373212, "uuid": "31813ce1-f599-4710-9d62-3d047af35ebb", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373212, "uuid": "054e9d32-cb50-4003-a9c0-da6fc4c3d416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373212, "uuid": "0c1c1344-f895-432c-b9a6-ff9cea4c9b77", "value": "a923cf298231c277fcf855d7d4dc0fcf526028ca13dfee893f73ce801e142563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081b2375-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368362, "uuid": "e364a3ba-d4e4-4285-9de7-806119deebaa", "comment": "Malware payload (Vidar)", "value": "60d271a9be5a67e77992f41807bf2b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368362, "uuid": "7119dbf5-56bf-4dc9-beee-f5831838ea4d", "comment": "Malware payload (Vidar)", "value": "a933f1f56d70c7bffaddf651eb9edf8cf2a9604829e18f7d4d57816db7b16294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368362, "uuid": "ab4135c2-9495-4be4-907a-b90e3ada02b0", "comment": "Malware payload (Vidar)", "value": "c33db6d35e53d62527250cb1e223469d9f59fb8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368362, "uuid": "d9fdcc9f-55bd-49f7-836b-ab4eb0e64ced", "comment": "Malware payload (Vidar)", "value": "1831b00540ab5e2cef7baf58e73303e6b177bea83e17deee16796c0db6ac42e02cde8bc1c3e7424dbdf8c786b721b56b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368362, "uuid": "3f7beebc-ee65-4cfc-af7b-c8c351abde2b", "value": "T101825345E11B9AE8C4E5C733632A526365FDB85022365B3B9BDCAB7A4D41330F7502EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368362, "uuid": "a3c31b52-883e-4ee3-98d9-4c201080fffb", "value": "7a396f1c6c658fa69d74e5c4a16df8be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368362, "uuid": "59ba5cd1-c9b0-4a4c-a59f-14719469a4af", "value": "384:vGlQ+BuJMMFwvY2NPc9ezvXUgFTvTUcuPkFclY6rNdRl8NDKYT1TCsCg:vYuJBwVEwzfNS+6378NDKYT1TCsCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368362, "uuid": "2dccfba2-4c9d-439b-98c6-7b021c802935", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368362, "uuid": "a4f9997a-fa1a-4f01-aa67-d48e8299b08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368362, "uuid": "09efdd6a-509c-41f5-9891-a77aac6a8b11", "value": "a933f1f56d70c7bffaddf651eb9edf8cf2a9604829e18f7d4d57816db7b16294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e29a63-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370926, "uuid": "bbb7c6c5-9b91-4091-8410-b9a5cc3a36a2", "comment": "Malware payload (njrat)", "value": "fee6805fb73267fafdb82d761619ce01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370926, "uuid": "6f698175-90ef-4303-803b-a5bbf4bd65bb", "comment": "Malware payload (njrat)", "value": "a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370926, "uuid": "c9db9866-8fdd-44b4-afba-6ade3a196d8d", "comment": "Malware payload (njrat)", "value": "839aa76c931130539d167cca5e70770e72fe601b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370926, "uuid": "ab57e8f7-4358-460d-8f41-bb4a262a53bb", "comment": "Malware payload (njrat)", "value": "f1305f16ed0f309829d8c5e3c2f962e98050c6b9db92a005024ef5b716df47257a430f7209af35fdf6e2e9ee1ca2a577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370926, "uuid": "da192cd3-79d2-4d0c-a28c-eeeaee026297", "value": "T116150255231ACC02C6936FF15EB0E37504B99D88B911D3338EFABDABB86E7826D111D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370926, "uuid": "3dd5efbf-128b-47e9-8a9f-71b0744d2ff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370926, "uuid": "70bcedd9-09d8-493d-9c00-827553b8eee1", "value": "24576:gFUjR6pFsRrXHAaD7Xda+46vNeVzjoxd/6/ASmyDa:ttimRzPD7ta+4cNedoxd/+ASHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370926, "uuid": "a9f642a9-2408-43d3-b185-3557f21e2819", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370926, "uuid": "ad408019-2f0d-4637-a6ee-ee315403cd56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370926, "uuid": "d844fae7-0fab-4010-9f83-1438abe352b7", "value": "a995adaffdadeea2a3e087910f65433d135bb9a47d46a3d901dda31d7c1e0d3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597a20f9-9481-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786341869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341869, "uuid": "2448ed5e-660a-4a3f-9c96-02ad53b159a7", "comment": "Malware payload", "value": "56974e453cc4dab310cd03b97d7c48d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341869, "uuid": "4593d8f2-bbae-414c-8a86-6cbbe10dbd0a", "comment": "Malware payload", "value": "a9ae330d06a6726f52d540555500cd80ae5c962f1fbff3c70cc76469592da0d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341869, "uuid": "21c94762-e540-461c-bbc7-c5445905d5e4", "comment": "Malware payload", "value": "beb784cae309a97a273f8b0474b2b91c013ac4c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341869, "uuid": "7abc1ee5-898b-4b1e-bfa7-af1273cc2f92", "comment": "Malware payload", "value": "021f8d9210b183e9131ff7b2883724762e02580a645ffc46e9c48a16d90c124c44822acde5fd1c34702c94c03e7bdea1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341869, "uuid": "19275c6a-3326-4ea2-af47-5baced0c3e3d", "value": "T119265C13EC9665E6C0EAE2358A629253BA717C483B3123D32F90F7782F76BD05979344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341869, "uuid": "cb5870f2-8624-4042-a220-a23af28f46b7", "value": "49152:CgL+Sn+S8TpVXA9K/mtrgr9xg2CL/JnhHCAkMwrdJJPKZKDKWKZBONjLq5ER:nLpsAFgr7EHLnmHKZBONHgER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786341869, "uuid": "21d86840-c557-4adb-8e07-95df985837cf", "value": 4469028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786341869, "uuid": "91184532-fb9a-4d07-a3b9-73ad8119d136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341869, "uuid": "0687c0c1-5d25-43d0-a07c-fe97ce2ac359", "value": "activemq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bfca6f-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372980, "uuid": "ef76e4d2-a2d4-47e3-96c3-a479de523e0a", "comment": "Malware payload (Formbook)", "value": "3f81f6a19c419a9714bc9b86f3def848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372980, "uuid": "c55de861-7b56-4a01-a088-ca5f4bc06c02", "comment": "Malware payload (Formbook)", "value": "aa07032bf63046cc3c2316990ab31d20d861ada7f77d96356f83bcceef4487ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372980, "uuid": "b2b87631-14f0-450f-9b30-f5547c1c9325", "comment": "Malware payload (Formbook)", "value": "0dc555e32dd5fe533107cf441dda9e5077a30687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372980, "uuid": "09564304-b6e4-4d6b-bd1c-5f94779fb411", "comment": "Malware payload (Formbook)", "value": "1a82e499f2c7b70944172a289eebc834cb656b329a5f360efd9ec03a44f361b2aa824ed59ceb230d59547596abecd675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372980, "uuid": "cef578c0-bf32-4076-a222-85196a6a20dc", "value": "T1ED35F1042357CC42E0E68BB6A9F0D37432B41DCBA9E2D2976FE52FE379153C29594782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372980, "uuid": "fe841558-cf04-4f4b-ac78-cb44e968e71b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372980, "uuid": "338187b5-8fae-4f9b-804b-bb27876bb0d3", "value": "24576:np50pdAxKEY+m9HW/sH0YSqSLUnaCabR+VEGDA7Qp:npAH0YSqLAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372980, "uuid": "6b6f4903-33a1-423d-8860-a7002fec0dae", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372980, "uuid": "2647b0e4-16a5-4f18-b16f-ac266811e395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372980, "uuid": "83809736-f833-4f28-afcc-e2828e532a1d", "value": "aa07032bf63046cc3c2316990ab31d20d861ada7f77d96356f83bcceef4487ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0116eb0c-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373504, "uuid": "08e395da-a56f-4925-948c-d08e8e55ae2b", "comment": "Malware payload (RemcosRAT)", "value": "aeb16dacca53004e4d1f8757a92bba7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373504, "uuid": "84ef7c7a-8bdc-4b99-8356-de66096ec218", "comment": "Malware payload (RemcosRAT)", "value": "aa1133d1be8765813b2cb3eb375da7e850d21630fe439bc26cdc469e16ff810f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373504, "uuid": "5044ffa9-59e7-4bea-b907-3a0a85d23090", "comment": "Malware payload (RemcosRAT)", "value": "0c6d0cec6e11ce840df5ef6b17bf19dec5b176c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373504, "uuid": "25a0fee0-4f5f-4687-932d-920ce760c4e9", "comment": "Malware payload (RemcosRAT)", "value": "1411ffb152dd9dc287fcb0f62125f3793d97df56b31c34d4d64968453933ee918f3f49fa94b581cd31267f3e8f5e3a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373504, "uuid": "19226d66-23fb-48fd-988e-c822c70e6568", "value": "T10E5512452226DC42D0D68BB6FCA0D37833A50DDF39D2C2925FF66FFB38197815998292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373504, "uuid": "a19bd938-afd3-4433-aa13-7d89d2747cc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373504, "uuid": "77d1ca08-1316-41ae-9cdc-3cfdc6ec74a8", "value": "24576:acp50KVkXtpcIxULXCBTmkszxsPUx2tPWFxTQyBwaThm3RSs9cEV6Hq3:jpxVkpcIeLyTmksBMeTBB/Thm3ROL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373504, "uuid": "f96108dd-24f4-405a-9bed-d6c12b0e1047", "value": 1350656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373504, "uuid": "22b5243d-3213-4523-b0aa-65f16ef35378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373504, "uuid": "cfb4be18-4449-463a-90df-5343f8c2fd7f", "value": "aa1133d1be8765813b2cb3eb375da7e850d21630fe439bc26cdc469e16ff810f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c68441c-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369281, "uuid": "aed36f40-1c08-4a67-8bda-02b2d2e0364f", "comment": "Malware payload (Vidar)", "value": "b470597cf646fa1d1c5ac5a923e26ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369281, "uuid": "f6f09a9d-c48b-40b1-8498-c90784f94487", "comment": "Malware payload (Vidar)", "value": "aa2c6a216b2b2d02ad669829f2c315641ad7e8c2e80de9343bc5687d064eea10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369281, "uuid": "46736b91-75d8-4cdc-8a7a-1d9ace0d19c6", "comment": "Malware payload (Vidar)", "value": "a632bfc48f2b278800d61cc1611760684f9ea4e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369281, "uuid": "fc33058c-3026-4743-8274-cc5bdd26a675", "comment": "Malware payload (Vidar)", "value": "58433e372603b39c10d1a6f2c12f6a35d7c5e0a0007ac098ed65de93514163fca2ebe1faf1e400140a39d371150f8823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369281, "uuid": "8fb1d1a5-d9f1-4f7b-9f84-595c7d653724", "value": "T118520A89A187F0FCC6AAC33DCB5B5666D756308047394BFF9AEC4994378322175B8268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369281, "uuid": "d2a00a7b-3d44-4343-b355-d12d1c2b4fdd", "value": "f0e3160a5bd62fbc1af1bbb43e8f6a5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369281, "uuid": "06f8663b-7d4f-400c-8f80-09d020847e69", "value": "192:O9j6LEz+VlhXuwTFskicrUiJXrzrQAJ16EdrGFWgHV3Vc:OZTaX/4SlJ7HQAJTrG7HVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369281, "uuid": "bed101ea-a127-4037-ac95-bf54ad420267", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369281, "uuid": "8272698f-6e1b-460e-9845-01d14e04439d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369281, "uuid": "4c370744-08e1-473c-99e5-8b579fab685d", "value": "aa2c6a216b2b2d02ad669829f2c315641ad7e8c2e80de9343bc5687d064eea10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8797cc73-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372870, "uuid": "3ab911bc-f166-4562-9c55-d9fe0d1fe39b", "comment": "Malware payload", "value": "6f17d6cf3c835694ebcf73ff75b1c645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372870, "uuid": "eaa4b9d1-0cdd-46e2-9846-33e468c35565", "comment": "Malware payload", "value": "aa403a253dc7c4bb6ea4533c3b9102bbff7d28122ac22f3f1e6bf7c262bcfff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372870, "uuid": "2319c2d4-1c39-4502-8005-2adeb10eeb47", "comment": "Malware payload", "value": "c00be3b9efb43972344810a31ae1f6ee597f0db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372870, "uuid": "186f40bc-60be-480b-84ab-19c690a545bf", "comment": "Malware payload", "value": "26c94ded9adcf1a90de57f770d788aa5274ca825fd526777d44696e7965411a528c9f902757f785111323e0f577dbc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372870, "uuid": "c1da437a-f764-4983-bf87-61e07f132a38", "value": "T1AD071233B249E13DE06A1A365A72F110543B6E6C6D138D0A96E4F46CCF367A13D3E74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372870, "uuid": "3e7adf3c-5bf3-4e00-a931-9fcb4d5fec55", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372870, "uuid": "f3b4dbd5-b2bd-49ab-ac28-75b0185be52f", "value": "98304:roJJqWnG7Xui23AnLq/Y3WWpC01MidD1G1O52bsGlz+weCc8fcfQrIIo9eop6NEq:ed2wAm/kp50OEb+bCrfbrIIo6NELNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372870, "uuid": "ca267552-a6ad-4374-9cf5-935b1073601c", "value": 17025776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372870, "uuid": "2e86a685-4ea6-457a-8d5e-a86d76314697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372870, "uuid": "f49e3f6d-16d9-45c6-baa1-4bc28e60b1ac", "value": "aa403a253dc7c4bb6ea4533c3b9102bbff7d28122ac22f3f1e6bf7c262bcfff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264894d0-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340065, "uuid": "cc9c57fa-cbe1-4849-9bbd-fb4d8698abb8", "comment": "Malware payload (Mirai)", "value": "d62a122316e98d76a90bcb832444ae51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340065, "uuid": "380d6797-1521-4aae-8543-e91a5f5a9e6c", "comment": "Malware payload (Mirai)", "value": "ab53a6740e4c6569f1446104c8e96f978caa2f4395d2e1c802d5061e8349630d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340065, "uuid": "972496cf-66a2-40c0-9384-f7d2436d1168", "comment": "Malware payload (Mirai)", "value": "ec84d78e904fd967e3829f032d172ea02c6c1044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340065, "uuid": "af524044-68be-40d5-8415-99657b8b0573", "comment": "Malware payload (Mirai)", "value": "862c47d8140bb6e8115e96817a4638f7df19e7c146cd1cd3f957f32fa09bdde2eec2fe904abdecffd07cad658d29cccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340065, "uuid": "0bdb7ea5-bca3-4004-a6ff-d990ad94fabb", "value": "T176942A44A3B0D3DED1A6EE70233A3E1A9FA6062730977546211FFA6303B21714AD9DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340065, "uuid": "cb61e254-8536-4263-ace9-024f187fa42e", "value": "6144:/S1zDjpM5wpRIBvSeL/uYUrwU8aQlvuDk9mo2SGYWmTLy:/S9jpM5fB6eLdU0USvu4l2SAmTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340065, "uuid": "df3448f1-e4d5-4428-8f02-6e18ef97a7b9", "value": 439552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340065, "uuid": "ede0cfa1-cec3-457f-87fe-6b92e03a08aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340065, "uuid": "0bc73c08-bd69-43c7-81fc-f66a7df77d8b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45805dd-948c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346854, "uuid": "4ef83c16-f82e-4830-aca4-6b6740675c4f", "comment": "Malware payload", "value": "f329f0bad48bb85d1fbeabbc8c8eb085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346854, "uuid": "a81e3003-77f8-4fe3-aa6e-42250e586c24", "comment": "Malware payload", "value": "ab8ddb4b6339a7ac9d846716b76224d2be86e84f666534a186ef480c702b932b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346854, "uuid": "0799fd41-68fb-43e9-8393-7073fa932316", "comment": "Malware payload", "value": "77ff98268aa7efded81868d758e19fa0d3f9f65a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346854, "uuid": "526e68b1-280f-42f3-a414-37e17a6f8331", "comment": "Malware payload", "value": "36ccd4197cc60ea0d0ae2d9bf89476930be127ff133b14cc6ecb4bc37a5f2faba5e8fa3b8d1551d90cd69a867415fab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346854, "uuid": "d0396b24-b10f-47d2-a823-e1c783c80fd3", "value": "T1DFD2D506B613C472C10331F652F6DB626930FA7B6A248946C77AAFB1EA554C0A25337F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346854, "uuid": "75d47837-3689-4aa7-a6f2-eeda376925be", "value": "384:ftSeQWlypBhGuXufIew812HT8/qf30jrSPAwOiS9O8fUBW:FSeQKyDhufI7MynvP+dfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346854, "uuid": "490997ca-6054-4a0b-80ff-79e8f1ea3678", "value": 28356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346854, "uuid": "e5cfa5ed-c969-4baa-abc4-f6446c21449a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346854, "uuid": "8fdaa2c0-09b1-4ded-afbb-3179c7c7083c", "value": "main.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ef102a-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372653, "uuid": "a18e31fa-0b69-4ef9-a684-e7ca28315646", "comment": "Malware payload (Formbook)", "value": "a24dcb69144e16322b612b87b2e32ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372653, "uuid": "8d028d80-5cde-4bd3-a94b-a448a2e7c684", "comment": "Malware payload (Formbook)", "value": "abecfa755d697d7275512b68274d396ce7b4b7b3e4194547a5cd31e4d2679440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372653, "uuid": "2eb05d6e-769f-4c05-be84-151ecc85ca2e", "comment": "Malware payload (Formbook)", "value": "3ffb9338bb9866ca1d5f901dfdd1f65beca33197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372653, "uuid": "554f4e09-4e12-4034-acdb-4e77e99b1a78", "comment": "Malware payload (Formbook)", "value": "9c6103790d215a3d3375a45a17224ff1461a672da6410ffaf4ae0e212f4ef74f4fd087a5360e7695aa1c84c94fa852ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372653, "uuid": "61ee06a5-9f60-485e-b108-17e35ddf956c", "value": "T1A7350114231ADE42E0D18BF6F860D37432B54DCB7AE2C2829FD99FFB79287D15558282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372653, "uuid": "77e61d59-fedc-45f7-81a2-89d47551b125", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372653, "uuid": "9d015d5f-caa9-4188-b641-70e15b9fbd32", "value": "24576:clp50e3f78SV40d0JcYWPShTrTrFStPw/krdB6:0p7V40PYgIrTrsw/krd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372653, "uuid": "1ac49542-12c5-4eb9-b560-9e17699018b1", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372653, "uuid": "45467ff6-ab9e-4e90-996b-93960a625d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372653, "uuid": "b148df1d-ff2a-4f5e-94f5-6f6be0d2ef5a", "value": "abecfa755d697d7275512b68274d396ce7b4b7b3e4194547a5cd31e4d2679440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53003c4c-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786355602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355602, "uuid": "be32d00b-50b4-4b2b-88a2-b07a7e3ea509", "comment": "Malware payload", "value": "c47c1adf1e7685edf30cb9c57baec5ba", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355602, "uuid": "ebfa52af-0eee-4592-a251-ba2f5c34b986", "comment": "Malware payload", "value": "ac33dbe92dd985a21c685197a8125cb6b9353d8ad693a7a03c944754e713444f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355602, "uuid": "b2ccb2ae-1732-41ad-bc53-d38c03f6faef", "comment": "Malware payload", "value": "66d9c3a8afd692d5a8d8fc4fc976f019fe793a1d", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355602, "uuid": "d216a2b5-c932-40b3-9c66-d23fb68da20d", "comment": "Malware payload", "value": "4b3d426260690def5687aaefd7a780e83462b9968aed18fab09441fc6058acc98bbf605265630a82d7a6e9e6b6a85858", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355602, "uuid": "7e8ccea7-60a2-45dd-b319-6a1322e1f765", "value": "T15F1134C6C8B99E13FE814371E872B92376B489D243F2540FA921248EB148CC2A747BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355602, "uuid": "a601b991-29ce-4360-a595-54208ac40c3b", "value": "24:2dtWa6ffa7b6flYX7a6flYR7V6flYIO7o26flYq7Q6flY6J6j6flYN81LWJ:c01naX6NYXG6NYRh6NYVN6NYqk6NY6Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355602, "uuid": "77569143-d1a9-443d-9765-06c2467cb47e", "value": 950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355602, "uuid": "20eb01a3-1f43-4056-b31d-2a3f58a20330", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355602, "uuid": "c9913d31-d134-4620-97af-68043826ea72", "value": "PurchaseXOrder_W2434200.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d915aa4-94df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786382222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382222, "uuid": "5ae161e0-7827-42cc-a44d-1b115f7d28ae", "comment": "Malware payload", "value": "af5050d06e27ec8d0c69c166e291e01b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382222, "uuid": "a573ebad-cf62-4959-9715-a06969aa3df1", "comment": "Malware payload", "value": "ac685c11d93323bd0d1a3bef2b9f2f1cd0b7844a8788e59be9468c3d10e2e068", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382222, "uuid": "c81cc7a3-53c0-46f8-912e-02510a117cae", "comment": "Malware payload", "value": "72b18fe3e2e3f16d22cc5e2ba2b7c02a425ef5a3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382222, "uuid": "fd6303fd-944d-4e67-9d43-0207af4baf84", "comment": "Malware payload", "value": "41c78d1ef17f6a5ef1ab07b65005e3e643477a71640f3266a2ada2b3f5c24c517d88ef2b029696b89b47f5d6a4092beb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382222, "uuid": "7599126d-be56-44d0-a72b-87a02a7bfeeb", "value": "T1F9089E15A3EC0716D1BEC279C6628693E6B0B8951F51C2CF0459DA8D2F63FC05EFB262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382222, "uuid": "8054469d-3898-42fa-87c9-42168a22efe9", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382222, "uuid": "f764cf62-c7b3-465a-bc92-07dc8ae3d6ba", "value": "786432:w0XviV5OtsFjFsx85vm7fR19qS+BsXJTR:raExo4fJvb9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786382222, "uuid": "b8706c4a-068f-4eb9-82a3-89495bd221a6", "value": 78512261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786382222, "uuid": "25ca3e6e-bd28-4416-88bb-da94482c8d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382222, "uuid": "e1a9bd52-86ff-413c-92e1-5b6c0dcffb9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb127c35-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369118, "uuid": "8848d2ef-9b57-420a-b01b-5c1566447aab", "comment": "Malware payload", "value": "09eeb270de83e34054818cfd0e550015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369118, "uuid": "fa0a9bae-077e-4deb-b19f-c60f20155cf2", "comment": "Malware payload", "value": "ac6a97c8f4e614c932e59d1939b90af10a9ef2cb5634d2e5b27bf6bdb99c881f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369118, "uuid": "1a14b973-8eaa-47ad-902b-e39b156ef98b", "comment": "Malware payload", "value": "e7297f0b0f596dc637afddd4a3dca8a1ef473ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369118, "uuid": "16a2f008-9d60-4615-87a1-7363c482cde6", "comment": "Malware payload", "value": "8ea1a654da578e8878659eddc219de2bab772e3184b89e3332feb32fd23c0135af8f3e15b657eb5e906d47a46b3b183b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369118, "uuid": "4a45f107-4130-42e4-b9d0-ca795b270cef", "value": "T15464E1B1B931B8D2F1ED6C315FA5DB7B4F6A9031A9D07B336344690696073C0E92E0AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369118, "uuid": "3db9b9e8-e08b-486b-9a07-c9f0cd018ca0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369118, "uuid": "6cd13438-27c7-40ed-b25f-574a88ae1b00", "value": "6144:Cbfope4X9ZPA5q4IFGvspO8IjtpBKax79tzDDLd6/C1:CbCZ5ws8jtp9dt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369118, "uuid": "7833a6d9-e4a2-44c1-b917-97dca46fa8d7", "value": 329360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369118, "uuid": "713213b3-d2d9-4199-9aa6-4377173d6e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369118, "uuid": "8ae0adbd-3eea-4e70-8032-443cc346a2d4", "value": "ac6a97c8f4e614c932e59d1939b90af10a9ef2cb5634d2e5b27bf6bdb99c881f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9255e2d5-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368164, "uuid": "19b9a849-da2c-498d-987e-4eda1090541e", "comment": "Malware payload (Vidar)", "value": "e8b2f53ecd3db43d48115cf14ac7f270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368164, "uuid": "95f5216f-7fbd-4124-a7a8-c091b0ff6c3c", "comment": "Malware payload (Vidar)", "value": "ac859a160ef7c2351257ed4855348ebdc5e399389df48283fb041cb71fd21317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368164, "uuid": "e46a3a52-97e8-44e6-8f50-063b01be1b21", "comment": "Malware payload (Vidar)", "value": "5ff92bd69f6485dbded27e25ff063103f22b4f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368164, "uuid": "543ad139-74ab-4bdd-9100-32c05bffe685", "comment": "Malware payload (Vidar)", "value": "046a5d1744341d1a90752576a33a225d12c0b34cc7dd253c0f6000cdff21323c5712a2166ff8f9f4b59020af468827b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368164, "uuid": "d0cb32b3-80a2-454a-8f48-c66fe23dca2f", "value": "T1D752E7CE70DAA1BDC299C7B8C72B45B6DB6A30851B105EBF47ECC25137C32107AB8A55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368164, "uuid": "8d20e089-0e0a-431f-bf61-d4f62fb955a8", "value": "f6ed7a812e36f2c87231645354e7939d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368164, "uuid": "5d8b96e4-31ce-4975-9769-bae9d11aa5a2", "value": "384:m9aAWxnKjkTPppsO01yDIgtaklLJcl5Nt:ugTG16R9cf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368164, "uuid": "6192c9f1-fc3a-463f-a84d-7bef94cb8b55", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368164, "uuid": "04a797fb-6dc8-4941-9aa0-bfd23aa9f62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368164, "uuid": "2c4ea506-b047-4902-b347-6449a8e27ad1", "value": "ac859a160ef7c2351257ed4855348ebdc5e399389df48283fb041cb71fd21317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2594c307-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370559, "uuid": "569a199c-d001-4331-8772-a166fe376c20", "comment": "Malware payload (Vidar)", "value": "9b251410ac48345cdd1a67bb8c7ee929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370559, "uuid": "e576c077-6559-4380-996d-d71d44c15671", "comment": "Malware payload (Vidar)", "value": "acf726b1ecbc1eb19cdef35551ba233081f4985da3490df9c37d154e4374043e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370559, "uuid": "e018c0bc-2553-4f4d-8009-4f8b61816c79", "comment": "Malware payload (Vidar)", "value": "cf51630aeee27f958d556bc3c2fe7bca3f038edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370559, "uuid": "5a7abbe3-bc91-489b-befb-1992a8deb2df", "comment": "Malware payload (Vidar)", "value": "2ecb7ac213ae916d9e45ab285d8403c546f8baf15d1174549b0ff22c738573b31f38d1ae02c4a873e0b53deeaf550c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370559, "uuid": "a89dc7a1-f6b5-45de-939c-551747f716ad", "value": "T15A42F8CD71D3A6FCC239827CDAAA07F7CB12305507166AFF46E9C991778361271B9620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370559, "uuid": "cab679d8-7e23-4ac8-ae17-771f8cd3b089", "value": "7b712ed6acaaa46c15e98d4925e3b962", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370559, "uuid": "5063688f-2be1-4657-a580-28c5fa35e10e", "value": "192:Ou0kXK/333WoTyHSVFklhfCVMgNXQDNLZlz8N3Vt:OdkXKP3rUIwfC+g5sNVpmlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370559, "uuid": "65d3ca97-d115-4d4a-8f68-46e4ee8bec01", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370559, "uuid": "28abf1c4-a28c-40ed-992e-612f8fdbcf8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370559, "uuid": "6adf073c-eaac-4c6d-8503-f5b153ec1337", "value": "acf726b1ecbc1eb19cdef35551ba233081f4985da3490df9c37d154e4374043e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d045496-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370678, "uuid": "6a975c97-874d-4e53-9a00-d236f15e7108", "comment": "Malware payload (Formbook)", "value": "c19d6576f97d54111b9435d3da3ff9dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370678, "uuid": "e8ca8b64-14be-4869-9c24-67158389ec74", "comment": "Malware payload (Formbook)", "value": "ad26f7257e7ae4470c92ad9974baf03a52cc55312593b14fd14e1f05c492eba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370678, "uuid": "801fae7a-f6ad-4b19-82ed-d9a7d0b73a99", "comment": "Malware payload (Formbook)", "value": "dd349bcb0a356a88688f4188bfff22a263f04050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370678, "uuid": "51428ad8-f058-4d4f-a4f3-0bb326d324f6", "comment": "Malware payload (Formbook)", "value": "9293e7b6d8dc21b7e647f97838db9aa002bdfb11b5bea10a5cf8ff2c1337b2278437f40a8f950952ca5cae20f7ff1cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370678, "uuid": "ee75cb5f-e890-4dc6-a36f-6565db02d057", "value": "T1E42522949A1AD922D8D20BB61450F33DA2759C9CD502E347CEECBFE7B50CA0E3D1C699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370678, "uuid": "e33a1e58-a7fa-4efa-9953-8b779823492b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370678, "uuid": "f2dbabd6-3d19-4cbe-aec9-7c6b81183cb9", "value": "24576:4jXfQAk/OY1sK00NhzzUUpjXD0yFYXmB2D4KF+:4DY+kDzw+jXDfFYXmw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370678, "uuid": "47d4d657-338d-4790-9736-dd91ed14c468", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370678, "uuid": "554e3f57-7f78-47d7-b774-854db6f560a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370678, "uuid": "e95313c0-38e8-42ce-9ec6-b633be8b7d7f", "value": "ad26f7257e7ae4470c92ad9974baf03a52cc55312593b14fd14e1f05c492eba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bd5a05-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369300, "uuid": "2f938f2f-48f7-478e-8808-524b7d74f7fc", "comment": "Malware payload (Vidar)", "value": "0d5328ab1f29271d2f6cbb08cdb7f005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369300, "uuid": "a47b3a53-d5fa-4c57-8b16-6e403dfedd98", "comment": "Malware payload (Vidar)", "value": "ad7a4ae654865eee8770894458876a976d7f26c5dda3e74ff8295b7b5e4b715a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369300, "uuid": "1158de32-beaf-4021-8495-954099a87e3d", "comment": "Malware payload (Vidar)", "value": "f7a2762b11892a3a7616fdb24b8e7abf85bcb955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369300, "uuid": "441fd7ab-f4cf-4542-9f94-1edf897ed3b7", "comment": "Malware payload (Vidar)", "value": "8857b5814016f9435f56858300c100fdb62a6be221051ae0845f90d93970dca9216d8dc7640f0ac075169bd4d06a98c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369300, "uuid": "618b9cd9-d02c-4a5b-9bb5-348f87ce5ed1", "value": "T179522CCBB157F07CE164C3B98A8F97B68E5630985B061ABF65DCC6A033C216031ADE61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369300, "uuid": "b386d812-839c-4a62-8e59-493a8c700148", "value": "11947076675cd2ccb7ede65c6ece700d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369300, "uuid": "5cb027d2-ece2-4f17-a4f5-96904c0cbc6b", "value": "192:OeJs0hxleyBvw++RoKJAnL+RSM8LraQnmj/Lv0bpswJRTtHxM3VY8Wr:Oss07B+eFLLHaLvvMVtHylY8Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369300, "uuid": "8e2d0175-f496-47fd-9405-a5d9d93bcadf", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369300, "uuid": "24beb6e4-65c3-4a25-8318-2f5edd4aeb18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369300, "uuid": "e18dfaee-f4c2-45a3-9f5d-a18ee839a6fa", "value": "ad7a4ae654865eee8770894458876a976d7f26c5dda3e74ff8295b7b5e4b715a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36506296-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (SVCStealer)", "timestamp": 1786374023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374023, "uuid": "3a9dcc79-d9e5-4f51-a3cf-1f34d8d6bfe9", "comment": "Malware payload (SVCStealer)", "value": "6667d0fd4a325f5a0fd7d071f780e1fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374023, "uuid": "d4ac4fef-1453-44c1-b2c1-fc26b77ea297", "comment": "Malware payload (SVCStealer)", "value": "ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374023, "uuid": "f38ef166-2f4c-43d8-836e-207ca2cba7fd", "comment": "Malware payload (SVCStealer)", "value": "c9c04f152ba5132ddd74dc6bc6681504debed9f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374023, "uuid": "63f78e87-f685-4245-b802-dcb198f590aa", "comment": "Malware payload (SVCStealer)", "value": "92c4ca05da71ba9ca4106b261fc5cd2bb949bba3dc4fae892f05d841a7a4b8b7c9bc2e2b2646628fe6f7bb1f274af754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374023, "uuid": "7ca0ddf5-11ba-4a52-a7dd-f47acd9e2efe", "value": "T1E7C633A990B18872E19169305B457EDF680CBC321B9F25B89F0EFBC998F8AD0D543D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374023, "uuid": "26326404-76b2-4a7e-9bc1-0b6f72ca524b", "value": "a1bbfb9ef9eed40038fab925f62024db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374023, "uuid": "5e265142-cfac-48e0-bda7-cdc78688af69", "value": "196608:HCrdC92o0axnXVOfX6IGBmJ27C5aivv2yN39iwFgvznOD7E2jzwD6:HqdC92laxXV+J2u5au2eEznJ2jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374023, "uuid": "2c67b569-fb22-485c-a271-cb51cf008398", "value": 11784192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374023, "uuid": "f511cc84-4b3b-4590-9c90-92fe12b8df71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374023, "uuid": "7b6975fb-7aba-4aec-8c46-2882549d75a2", "value": "ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0957c6bf-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373518, "uuid": "67490de1-ab62-4f32-b283-380535b74278", "comment": "Malware payload (AgentTesla)", "value": "3d7353c22708f1448f90128b28105f07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373518, "uuid": "6f9c82d9-d23c-4f06-a574-4373fc2ae1a1", "comment": "Malware payload (AgentTesla)", "value": "ada33b7d759984eb9e1c1ac741f7e97396f100e77ec891270ac5954cda59e356", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373518, "uuid": "24899685-b443-4a77-bff3-392a15003b00", "comment": "Malware payload (AgentTesla)", "value": "4e27be32686b82daeca37ab761be020ff8fa8499", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373518, "uuid": "7879057a-ce43-45bf-b466-ee79817dcc11", "comment": "Malware payload (AgentTesla)", "value": "1d4a3a9095cb0726901a36eeae2a495606e9a7ec03d5c1c0ee0779612dd6f3655b0637b3571666f1e07ff3dbb35646b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373518, "uuid": "f5abf945-c7e8-4aba-9b62-c3202d65aabf", "value": "T1D285F12A0DC74694C564BF7497B62FE812F1922F0112E76B97D663F8CA0D39F3642263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373518, "uuid": "7bdce43f-09ee-44dd-97eb-a8c4b2179929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373518, "uuid": "c3e71688-8b7e-4f24-b1e2-e972aee07add", "value": "24576:i5MgYqfK/zIVsmQb2hGUNlerBlRqHN9tayLVXfnb:eZibqhGml4qEwXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373518, "uuid": "fa9f4adf-551d-4378-9794-010f9258b199", "value": 1762304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373518, "uuid": "57396c4b-0877-4bb9-8792-fb3a2959fbf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373518, "uuid": "856f6d37-5045-4a37-a895-7b7a327cf269", "value": "ada33b7d759984eb9e1c1ac741f7e97396f100e77ec891270ac5954cda59e356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999596b1-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373760, "uuid": "ed841e6b-14e6-49c1-b3c3-a5d0a56e0b72", "comment": "Malware payload (PureLogsStealer)", "value": "04516f5fefcfc0cff04458d758ee6a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373760, "uuid": "26b6d350-2e73-466f-b774-db3ac93d9107", "comment": "Malware payload (PureLogsStealer)", "value": "ade88bbc33c4da56fca0d72bb7931c63754c503db1ed6d739737b8c51b1f12af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373760, "uuid": "3804c7d6-7df9-47f7-96d7-657c58971614", "comment": "Malware payload (PureLogsStealer)", "value": "820a1f270a9eff8818e49accbac8d9718456d50d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373760, "uuid": "ac883f72-0443-48a9-8177-398da0070936", "comment": "Malware payload (PureLogsStealer)", "value": "43567193322410371e2a427dfe8df2cd0abf3fc82a91d2e60a8521c7dd78794c21d5f4aada77014ff0d48901f89b7ffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373760, "uuid": "687e45e0-8541-4575-8214-1663e3925415", "value": "T19B75232816238802C9F27DB12EB4F1B067369DA9F139C2D54FD71EABF8AB1183D41765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373760, "uuid": "12a5dce7-7da7-404f-92b8-cd98f187339c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373760, "uuid": "ffff875b-84c5-4e42-ab65-3438f4c8ae5b", "value": "49152:UA74JHYiBLrTjl2zF52bDVWqfCSMa74WnUnLds5Jm2:UA74HtLPuU4ICSM8UnU02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373760, "uuid": "0694a39e-137a-49dd-93e2-115ad9405041", "value": 1628160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373760, "uuid": "c9ba74d8-05a6-4957-86af-7a1920ede72a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373760, "uuid": "3cc8f607-6b4e-4d9f-be2f-a872744a3005", "value": "ade88bbc33c4da56fca0d72bb7931c63754c503db1ed6d739737b8c51b1f12af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6847f2a-94b2-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1786363151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786363151, "uuid": "2fddf83a-3e29-478f-9396-cb309e2422ba", "comment": "Malware payload (LummaStealer)", "value": "1b076ebb9d35f1258f588e881568c857", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786363151, "uuid": "a6d01195-44f8-4b52-a043-0a0999a330fe", "comment": "Malware payload (LummaStealer)", "value": "adedb76b5b1859f620895bf12670ded2ced8ea0756757f144c59612172c2c1ca", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786363151, "uuid": "fa627b12-3d97-4b81-8adb-2175922bbec0", "comment": "Malware payload (LummaStealer)", "value": "4a85d8611b45d01bbc968c52d7f9c64f09710391", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786363151, "uuid": "4f7c1e3c-c6d6-4c13-a0d0-d0c177008f61", "comment": "Malware payload (LummaStealer)", "value": "d5e70325ab5441a03e04daa7f75ba00be911ae4487722325790e0ee8b2e76a7733a03628ba8f6718d1e4f3c426c55ae8", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786363151, "uuid": "ce136403-3dbe-47c3-bf09-29ba99057a97", "value": "T1E3761801EBCB84F2D8562B30249B776F27399C090F7AD663EE543979BE733501D22689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786363151, "uuid": "b80ef224-0371-4472-a0cf-cf202fa54a00", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786363151, "uuid": "b2d30f02-a0a2-4e81-a70f-318ada41c996", "value": "49152:pIB+UOi20Hdc11gLEUQa4gLbY68SLqUx6j4p1E1k1bQposR9:mgUOD0Hdc11gTQzgfYfqTr/TiposR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786363151, "uuid": "98c8916d-00be-4a17-a032-239f9df2df60", "value": 7147864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786363151, "uuid": "bc99e35c-c59a-430f-bc92-c51e24801e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786363151, "uuid": "3bf723ca-203d-4dc1-b309-4c7afff5b9b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dec055-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370666, "uuid": "7e40d1ca-ef75-4196-a92d-d10d97169e93", "comment": "Malware payload (Formbook)", "value": "c797177ea41273f0fb1f3abf381a30b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370666, "uuid": "5c981345-94e1-4e8a-8f15-13d8ba0153c6", "comment": "Malware payload (Formbook)", "value": "ae02fc8ea89d98f9c04b25707f15afd2a22237d25e3718274bc8e8ec6ea9da8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370666, "uuid": "bd4de464-f274-448e-95ce-2cbe8209a73b", "comment": "Malware payload (Formbook)", "value": "ec56132ba1fd30247dfa38fec267d736e683efab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370666, "uuid": "75b956ae-6440-4e5f-ab41-6fd2a2d979a5", "comment": "Malware payload (Formbook)", "value": "0ba8755a5d2b4f52d96aa98195d89bd5322cc46da325e652666728238ef589fb031a514cc3dbd48836026d4bd6f6f4f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370666, "uuid": "fb317cb7-328c-4699-b8a3-1c2a04e32505", "value": "T1142512A09A49DC02C4C207B19971F3FA52B59D98E901C30BDAFDBEDB3C345066D6DA87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370666, "uuid": "c8fafb92-6fb5-4701-b25e-0aaa1393d0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370666, "uuid": "082568cb-5fc5-4b98-907b-712ca93fa8fa", "value": "24576:qAJC6sio/dAEx1lK/GSPvUmfF3g2xk9x1U/Wi:qUhsNzxr2GSLN3rST1E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370666, "uuid": "48dd73cd-9c4b-4522-b7b6-2afd8bad0178", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370666, "uuid": "bdd2f471-c162-4baf-a0c0-69ffc764d372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370666, "uuid": "aab9e9fd-c0bb-4365-8c1e-e155c9b132cd", "value": "ae02fc8ea89d98f9c04b25707f15afd2a22237d25e3718274bc8e8ec6ea9da8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a155bc-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349619, "uuid": "37c4c3b5-50cd-400b-8a24-fc1c0f7d7488", "comment": "Malware payload", "value": "06f7186b9fd126253a3b31da0f9af1de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349619, "uuid": "9e207620-be95-4ad5-aeee-6c9a3ff6fb67", "comment": "Malware payload", "value": "ae4239888b4dad246683b218fc417855df1b074e1ae9c1f06cdebbdf2363c902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349619, "uuid": "0736a2c3-2be0-46fc-ad67-b49e10fcfa6b", "comment": "Malware payload", "value": "2033cc642d85a7bddf3118c898e476723cc38c69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349619, "uuid": "ef16115b-196f-4b0a-a092-071776a475ae", "comment": "Malware payload", "value": "601ceca2e442ff9c30534b27244bd1bb760873e446df6fd418a5e9a7af98a1dcd940023e071afc1812fae9e792fc018f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349619, "uuid": "8e47f8b1-65da-423c-abf8-5721d37aca86", "value": "T1E3B64A47ECA545E8C5AED135CA669252BB707C485B3027DB2B60F3283F76BD0AE79310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349619, "uuid": "f35363b4-c632-446f-86bf-895e857f63d0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349619, "uuid": "0ec822b3-5183-427c-b362-fe8080bff2fd", "value": "98304:Vs+06mU+/vUIEGXqAB2qldbU6fRkce3ykimB1PF2EEaO:VkUIEGaABtlN7I3ykim2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349619, "uuid": "daa97ce3-274a-496a-8b18-570ca561bb29", "value": 11209216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349619, "uuid": "9617aec2-7aec-4b3c-94cf-2097e9a37cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349619, "uuid": "a89a8075-e6fc-4b55-bd41-06f850ac1140", "value": "06f7186b9fd126253a3b31da0f9af1de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f861d0-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373378, "uuid": "ca54d0f4-f995-4639-bf8c-710de09db201", "comment": "Malware payload (DarkCloud)", "value": "eef3ffcf2baf5f0a896d5d195c46a5cf", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373378, "uuid": "11c6f707-4d66-431a-85eb-5850dc7d42c7", "comment": "Malware payload (DarkCloud)", "value": "ae64f509294f1808202261ecbc92aa049e04591799a65a325b89adcf6a70417b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373378, "uuid": "4d2ecce3-5322-4427-be74-7fae7d1de967", "comment": "Malware payload (DarkCloud)", "value": "89400edfd449dcf7643783ed8dbbbb3c458fbfbe", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373378, "uuid": "07734d2e-15f6-42af-af86-ea2f64e8c125", "comment": "Malware payload (DarkCloud)", "value": "cc6b12fb23fb16b858ced4fa590f3bf8c8effbd702927e680011d3841328be527e6e62766f3f7c22bdc61c850624334d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373378, "uuid": "ea981381-b463-4083-a64a-32bd96b8b617", "value": "T17D6501C5E94894A0DD59AB716A36CD3542237DFCA834D81C2ADD3E6B3FFB2836021467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373378, "uuid": "7389cde2-e880-4d08-a926-da16ea9a34be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373378, "uuid": "e2ee2566-b7b8-49e6-8c6a-22615983e39a", "value": "24576:3uHBYg+g+E6qSC0HH9hHOGA9GT4hyzMYQz2DgMzEVkGegbqfgxlHBYw1q:GaLOQRcGMhyIYQaUMEkyGQBa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373378, "uuid": "d61e9aa6-76f2-458a-9c97-855532119a81", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373378, "uuid": "14e8e917-d67a-43c5-bbdf-891ebdd16680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373378, "uuid": "dd4641bb-3cd5-40ec-ad01-389ca4d8aba3", "value": "ae64f509294f1808202261ecbc92aa049e04591799a65a325b89adcf6a70417b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2ca58d-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786372689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372689, "uuid": "e04f54a8-9b49-4777-ac5e-ca178685d9dd", "comment": "Malware payload (RemusStealer)", "value": "2142ccade495527ac596036ef7465815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372689, "uuid": "5321105f-341e-4c24-b2dd-cee8f3c94787", "comment": "Malware payload (RemusStealer)", "value": "ae95f94a469f6b2b77b758dce043a97a43582a7d56ac8b6699f5fd5687c12b43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372689, "uuid": "7942c3da-1139-4691-ad65-1f2a707d179b", "comment": "Malware payload (RemusStealer)", "value": "83de41aae1e4f368058d1f5d48d4cca1f36c6f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372689, "uuid": "e0a43062-10ff-416a-8646-7518541dbf59", "comment": "Malware payload (RemusStealer)", "value": "c4a0cc0bc110540a3ed49c04b8b6dea68483efc09c6092746a262fdef8726067e8ea24b89d9a2a77f8456aa63840e579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372689, "uuid": "0dc1dfcb-5a18-4e8b-8e62-64466256fd06", "value": "T1B8464A07FC9149F6C099A33189B29256B775BC090B7233D72E90AB383E767D09D79B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372689, "uuid": "fa8a82a9-213d-48dd-91bc-76244f5ced29", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372689, "uuid": "ec7a13db-74de-47cc-b3c7-757f59678060", "value": "24576:W5HW7bI8o8p6kPohIHoConQvfoEqXBR6YXW6Rky2aso/9zk8vAoBele5I9DPKf4m:W5Hm08r8kw+HoCoufn4DjkfaxkPVDul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372689, "uuid": "cc4dbf91-aebe-47fd-baae-ca54ba3505c8", "value": 5636096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372689, "uuid": "9de30fa4-2694-4e6d-b33f-f4e6ce1bd94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372689, "uuid": "93436dca-6075-41a3-a96c-70b53b0b97f5", "value": "ae95f94a469f6b2b77b758dce043a97a43582a7d56ac8b6699f5fd5687c12b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243545e4-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340062, "uuid": "f2001c79-4a40-46c6-8a8c-a6ce4577dd39", "comment": "Malware payload (Mirai)", "value": "2167b487a252671831cb022eea6ecd1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340062, "uuid": "90fa96d7-7859-40d8-8354-a9dc97a4c6da", "comment": "Malware payload (Mirai)", "value": "aed7abcff180c17fff3a7f78a709db25daa187513132355641d541cc0d54ec20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340062, "uuid": "a0ce3aef-ecf7-4ab5-9c54-56b7fb28dfaa", "comment": "Malware payload (Mirai)", "value": "38517104d714413f885ce0ebbf248f48bd8e357d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340062, "uuid": "78249b23-644b-4f24-a6e7-aaadfd0f1ae1", "comment": "Malware payload (Mirai)", "value": "20fd3c646fa87078fe10cfa7a283699560b654e1d53e06578ef75d5ffdccd98487780f98443dbf04a26bee4ee48fd753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340062, "uuid": "55cd0c61-8bf7-4b91-bbd5-9292b6c1f748", "value": "T11984FD88B5F2E2CAD1D4EAB5B319784D3B630735B1D77146A50EDA3323EF14909BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340062, "uuid": "d90dae0d-8b34-4ad7-96df-eff0d71d1deb", "value": "6144:ghlZa9UsG7bE42jhAf1oY7gYiZehSN77CnM26+jhHpUCC:ghlZa9UHE42G3Zib72M1+jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340062, "uuid": "f131223c-43ed-4f20-921b-95e39c943031", "value": 389856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340062, "uuid": "377ce568-0611-4623-9a61-9990573851c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340062, "uuid": "3b19a970-dab3-4cb2-9f27-467d1c6f0256", "value": "vlxx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1eee322-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369559, "uuid": "01c40577-9cca-4bd5-b7e8-10fc7055ff29", "comment": "Malware payload", "value": "8024646fb0e9f1622e72cbaec87cea11", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369559, "uuid": "fe0b3c64-dd96-4aa1-a148-cf7a2fbd8444", "comment": "Malware payload", "value": "aee8707c4d78ad9a674b228148d888a059807bc99b5d96676ea96922fb84b3cf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369559, "uuid": "aa39556d-45ae-4b17-b28f-ead21106f37e", "comment": "Malware payload", "value": "fb96af6dafdf3953451a400bd7fa6a65bde3b205", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369559, "uuid": "4bf81b81-833f-4309-be9d-110fbe93065a", "comment": "Malware payload", "value": "229e7cf07ef7360d502f43df51dac668a4443e99dfe22f6eb5598be1c60ac7dcfc16cc7fac4be13adfad436afcd147e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369559, "uuid": "f5d492bf-40d1-4b0f-a797-00fc7adf2d7c", "value": "T1B8C28D966A867C44BEC94A3E4CBD2B1D6DF5C3E1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369559, "uuid": "486ffd08-bded-477e-be51-4c3d1e1ad96f", "value": "768:W8vCB+25j6es8Ry4Vh9FYpMSUpi+20qUpi+20YQX:W8l25Jy4ld2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369559, "uuid": "54934bbe-3de3-463f-ac6c-db901841fbe2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369559, "uuid": "db0205ab-b32b-4dd0-aff9-ca9a1e437f6d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369559, "uuid": "25cdf750-4b23-4890-8bb0-3dfe641ecf23", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bc69ed-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373275, "uuid": "10a382f1-d853-44d7-ad38-148185dbddcb", "comment": "Malware payload (AgentTesla)", "value": "d3a3e5d677e962cabefabf99daa3b22b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373275, "uuid": "61e05af1-d21c-48dd-bdca-7e4a310431fc", "comment": "Malware payload (AgentTesla)", "value": "af2f9637149ae7702d83a35ca1768f753bf46e5dd6902e547bd76f96b1446a7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373275, "uuid": "04d542a8-ce96-4e87-bc70-9214042be4e6", "comment": "Malware payload (AgentTesla)", "value": "d1475d9b431c736a07003781cdc24eab88ed1f67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373275, "uuid": "b159d3e7-2d46-4ad9-96e9-323c6c7bcb72", "comment": "Malware payload (AgentTesla)", "value": "cf22eefceae26fd257bc343834c7e151479ea0a6114d6ab9a2a6eb0f6e1fd7409debfd18074f897f077243071e1fdbe6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373275, "uuid": "1a124016-547b-4d29-9b45-5b510bb62bca", "value": "T15A2501142316DE42E0E6C7F6B960D27033781DCF78E2D3A15EEA6FFB78197811A54682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373275, "uuid": "de73e113-4556-4735-815a-97e23f1ea172", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373275, "uuid": "9ba448f5-c37b-43b8-beff-49b11b5ccf39", "value": "24576:FIp50VjsJfzcDkYYVeG5prn8IRMqES7L6k6OYyH:Wpsj4fzcDkj7r82v6Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373275, "uuid": "786db1ad-488f-4007-8e91-7c2c88849e03", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373275, "uuid": "aff91484-827e-4b99-aaa4-035f6727ee91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373275, "uuid": "e1a4a826-1198-455c-adc1-aa40476033b1", "value": "af2f9637149ae7702d83a35ca1768f753bf46e5dd6902e547bd76f96b1446a7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174a599e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373971, "uuid": "7cc2f531-ad67-48aa-a737-64741d7ddd63", "comment": "Malware payload (Formbook)", "value": "44b086e40e56120110f8903fb1f25283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373971, "uuid": "fd67cf72-7f80-45a4-861d-1ef159c71dd0", "comment": "Malware payload (Formbook)", "value": "af422171aae6f3132d3ed234616a19fc51b524968599fcfde9e05e81a6e5ab79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373971, "uuid": "96502896-c615-4133-b025-a1b4d895e89f", "comment": "Malware payload (Formbook)", "value": "bef8290e150cb2953a5801d975a507c957bb58a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373971, "uuid": "b1dcfd51-7042-4444-8715-ca4e9a9652e4", "comment": "Malware payload (Formbook)", "value": "4676ab6b2f3f13bfa0e74e76dc1cc43a0b0fa6774c24438a5c06f3a31c111994068904d5b08eca40d08d5b5831908a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373971, "uuid": "06b41ebe-00fb-4d5a-9526-f9fbd4be4d37", "value": "T1F12522953A69CE22E43F4FF01572E23063B56CAE9920D7151FE66CFB7543B282924327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373971, "uuid": "2637605b-7fea-4327-959d-8ae995dc75ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373971, "uuid": "13cf8f13-1589-47cb-8e94-7e1746eb52eb", "value": "24576:8/fHpw1/feRA88vUU+1ehE+zUQ1HYr0lOuUAvAacnDORa1XW:Yv6UAJUoyqJY4lRmnDOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373971, "uuid": "00325d43-eb54-4abf-a157-024654846b0c", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373971, "uuid": "e64ee264-64ea-41df-a6ae-6af7162f9c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373971, "uuid": "2f87e65b-0dff-4536-b988-60d8aa5be453", "value": "af422171aae6f3132d3ed234616a19fc51b524968599fcfde9e05e81a6e5ab79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04597217-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786368355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368355, "uuid": "a7ca6b52-0345-47b5-ba4e-f22835e0d139", "comment": "Malware payload (PhantomStealer)", "value": "08d04806a27d83a5d32663b1f0066701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368355, "uuid": "b7a2ad2e-fbcb-40a1-bc07-57239c803c90", "comment": "Malware payload (PhantomStealer)", "value": "afa95f8089310841b669215cc5b699fe05c7560dc2e180387e60a129a91cdd7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368355, "uuid": "00342cef-4942-4c7a-afd2-18901403aeb7", "comment": "Malware payload (PhantomStealer)", "value": "b1509998859103b3a828951ff971f6f4f67cf4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368355, "uuid": "42531932-a8cc-4670-a4fc-c8b203a57114", "comment": "Malware payload (PhantomStealer)", "value": "f8e57286bc8056b2b9800dff3fdce4e84418531d739c9de80160ae9d5c386ac942565d2ecf412b3ad2f2885cb51a8716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368355, "uuid": "3ff162f5-a0ac-4205-8081-63953b48c558", "value": "T1B07523D03739B709DD260930A838EEB512B92DA8B024BAF25EED7F5B795D2019D0DF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368355, "uuid": "ea5e7e54-e47c-4436-aef1-23051ca7cfba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368355, "uuid": "ed945d91-148f-424e-afe0-ee9478233bec", "value": "49152:7hR9AVEKkh86TY/QUeFwDWhOyVeF0Xa6Qk:7bWVZkm6Tg5eFwDoKF0Xa65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368355, "uuid": "c11e42c9-d2b8-4146-a3ff-6469af2e1db3", "value": 1609216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368355, "uuid": "52a1e509-a07f-4cd9-9c26-fba27bc88b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368355, "uuid": "a8cfaeea-fa2d-4c95-aa1a-b5aba7c00566", "value": "afa95f8089310841b669215cc5b699fe05c7560dc2e180387e60a129a91cdd7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3745875-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786370474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370474, "uuid": "f5ebf603-eb27-47cc-97db-62d4a2c9f9e2", "comment": "Malware payload (RemcosRAT)", "value": "d756be3195b6db54adc7abaebafaea7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370474, "uuid": "7bd510dd-bf36-4353-9c07-5189388b57f7", "comment": "Malware payload (RemcosRAT)", "value": "afc733661a4cda54f02a0e90e1c98392db43abecbf6c0e1aa4c0196652e76974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370474, "uuid": "dc9f289a-0e60-4319-929f-d71c003bc9b0", "comment": "Malware payload (RemcosRAT)", "value": "47868334db7d0aacedf532938f21ce4634054e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370474, "uuid": "d0bde673-67f2-4414-ae72-4d256158d0d6", "comment": "Malware payload (RemcosRAT)", "value": "a678378b3e4728d299c46168b25e5707ff254fb86650a0897092a6fe493ef4b0926118ab507396bc19eae73bcb835f33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370474, "uuid": "a6d7da34-8e73-4b26-81c4-42558a16daaa", "value": "T1001512903F4DC811C4E217709A60E73823B56D85EE35C61A4EFCADAB3D79B07B854792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370474, "uuid": "55e67244-717e-40f0-bea5-aba79aaea5dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370474, "uuid": "95a26632-2710-456d-9430-488c5138027a", "value": "24576:DKlCvgnPhg4TSlpJFGy4z/8QbaZKh3WcbwG2kDRtb7mKn8Ah++bY:DKlCvgnPhg4mlpJp4z/hqDIn2Ab7xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370474, "uuid": "893db23c-7c3c-40eb-a651-832676a0ee12", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370474, "uuid": "9762d4ca-ef8c-415e-ac80-3e4f74199171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370474, "uuid": "9d09aca8-2f53-4d0a-a135-8660656de761", "value": "afc733661a4cda54f02a0e90e1c98392db43abecbf6c0e1aa4c0196652e76974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13882586-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786368381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368381, "uuid": "e90af44c-ae37-40f9-8460-5b8169924d89", "comment": "Malware payload (njrat)", "value": "e983568028789e0b915f007f6ad30b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368381, "uuid": "da0a8411-a3a6-48c5-b04c-a4a4175ae386", "comment": "Malware payload (njrat)", "value": "aff498fa20e630f15841a56ee598609553b24b1ff9f10f970770ef951c30d15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368381, "uuid": "e95597f2-0082-4686-97dd-4109ffd74e30", "comment": "Malware payload (njrat)", "value": "9178ee1e04019048daefd4676949dd9341679ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368381, "uuid": "3f6d1f2b-71ca-440a-bec5-a06982089915", "comment": "Malware payload (njrat)", "value": "d3756b9d9433382634b9f90e51d7e4e7aeaec9b75717685b2eaf4b02ea856f8ebf7e65fe38515c8796647abbecc033ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368381, "uuid": "1f896387-6c72-4a95-a086-7200fe20ab76", "value": "T13215E0C43B69AB19CEA907309474DDB543B92D28B001FAA31ED877EB79AD3109D0CF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368381, "uuid": "4d69d140-c59d-4d6a-943f-c905977fc23c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368381, "uuid": "5b007fe3-d5b5-4ccf-bd57-9304ed8f936e", "value": "24576:rUFysI6ELXJtAY60sBZkU9sn6p5O77zI:RsSLx60sBZS6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368381, "uuid": "36bc8847-c091-4a41-8994-304b2ed612a3", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368381, "uuid": "55d0dfe6-8b36-4e1d-85a9-ccd21f294825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368381, "uuid": "3cf7973e-efc1-4c08-b6f0-6f736642f8cd", "value": "aff498fa20e630f15841a56ee598609553b24b1ff9f10f970770ef951c30d15c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d58e16-94b1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786362747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362747, "uuid": "99ce8be5-6cdf-457d-92d7-af24ffac422e", "comment": "Malware payload (Efimer)", "value": "45b3fa36398e2ea448d282b7a231cc91", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362747, "uuid": "d4e4556b-51cb-44c2-bb0a-958da7d8d2ea", "comment": "Malware payload (Efimer)", "value": "b00c82498add1b39b26108461e630354bf9526fd0b040d86f2345872208f1060", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362747, "uuid": "8031e006-08c0-4f98-b861-c06805859c29", "comment": "Malware payload (Efimer)", "value": "f63530a9de0de1343377fbd8373d7ebba116a3d7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362747, "uuid": "7b0da4a8-a846-43e7-b993-13e94551c456", "comment": "Malware payload (Efimer)", "value": "134b12478f66861ea497c819d4b9efbdbd47c2fe588b0b194687adc9a589a51e3f012a5bcc988c99fa460f79f87f9ce0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362747, "uuid": "a52f1052-faa4-44bd-a497-dc1630d214f4", "value": "T1B2E63304A9C152F9EBB3107CCDE24651E626B83627B3C9DB975441A27F273B08C397A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362747, "uuid": "101ca437-9bae-4995-bffd-4b1201d61516", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362747, "uuid": "11a0b2ca-4e51-4078-b977-9adfc0977fc7", "value": "393216:Pd3OYcLA8q/bJj9m2zRY1rXMCHWUjRcuI3/PGTAI:PdLmTqpI2zRYBXMb8GH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786362747, "uuid": "3dfe1243-f9e3-441b-993d-455bbe060b00", "value": 14060233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786362747, "uuid": "36007402-c781-4f2f-8be0-915c578c6237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362747, "uuid": "6b5d4d2a-5a1c-4a1c-96be-b1595842f0b8", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7935dc6b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786371558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371558, "uuid": "2c6efc33-eaf9-47d4-8b65-7d8a5aebefa9", "comment": "Malware payload (njrat)", "value": "4a8110dd73c94e736f66472709f3bbed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371558, "uuid": "f98c0c42-efb3-43e0-86b3-818476d018e6", "comment": "Malware payload (njrat)", "value": "b061f1226ebc48fe38a86b036abb7e13007663cea61f977664a6b5c670c3dc18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371558, "uuid": "cbfc9de5-eb93-4c74-a05b-b0bfcbe754eb", "comment": "Malware payload (njrat)", "value": "03d43ee42ca3e7791273eade3ea41be0aa4f2bd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371558, "uuid": "58e92c34-fd33-496c-8463-4fbc5d491823", "comment": "Malware payload (njrat)", "value": "a064c55861151405394efacfdf465ae3428027de63e10e25124871a2eab94ca0bfa3273b7654b15c7a4ae8d8deef3a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371558, "uuid": "bbbcebe9-2d3e-4fe9-92fc-5c1c080224f8", "value": "T1DE1512086616EE06CD4513B51A71F2B417ADBEE9F931C36F6BDC7DAB3933A0158402E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371558, "uuid": "b7ba4b5f-b303-4bdc-92a0-662da40e17b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371558, "uuid": "76cba9ac-6891-4cc0-8bc5-ac397bf30a86", "value": "12288:1wlJdbHmlDh0nr6vSunNl280BAhjtAli1hzlGr9P8DMstyHzDWuXSK2t:1wlm8nr6vSuf9Nh2wQrl8DMx+uCK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371558, "uuid": "3bdf4868-1086-4cbf-af9c-9a5dba3ebc10", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371558, "uuid": "b1eee506-29c9-4d96-8d5b-75c1e5d9b8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371558, "uuid": "65ba616a-e24e-4d31-a8fc-d4cad6924c88", "value": "b061f1226ebc48fe38a86b036abb7e13007663cea61f977664a6b5c670c3dc18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae53815-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340046, "uuid": "4897c4c3-422f-4298-b00f-470a1fff6ca1", "comment": "Malware payload (Mirai)", "value": "d13f55af7e0adf2358dcc8817cb73a4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340046, "uuid": "12bcd295-b3d7-4705-a38e-76fc443a51ad", "comment": "Malware payload (Mirai)", "value": "b0899c6e1ee85c3ea39ea6e57edd8d1cd82bdf1bfc64b8b7dc029741581edd2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340046, "uuid": "bbd54b62-6d02-4371-9985-4d780b342dd2", "comment": "Malware payload (Mirai)", "value": "730cce49b4b8264bbb82d0b944a6e3f19f9fa54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340046, "uuid": "988d60f6-6ee2-4568-b54f-1033bec87f8e", "comment": "Malware payload (Mirai)", "value": "54d720bda9a070d0f3279cbc0076abac3db02b30c3eb28d032ae523040bbce98d3b392dc973d305d827a7faf3470a995", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340046, "uuid": "bf26b797-1080-4dbc-b6bb-61b34585ac47", "value": "T10F74398862F1E3CEE158FE7553157D0A4DA65A3335C7328A625FB6B322FB15C06EC920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340046, "uuid": "84ede2ff-55e4-409d-8c58-b0485f583d1e", "value": "6144:ta9Va9ma9ccxQuYE0j9fXgobls03GvxE2y05pRBb0czu3whQrZzwFG:ta9Va9ma9cc2iU94fV5Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340046, "uuid": "21797dc9-c9d2-4b7b-9182-66db2ff437e0", "value": 340760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340046, "uuid": "a908d604-e0ff-463b-bc2c-1f1920981fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340046, "uuid": "eec3fa48-c2ed-4aa5-acf2-f6976b046d96", "value": "riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa4a0e2-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339920, "uuid": "1e0d2327-e119-4284-ba52-d89ecc6a31ca", "comment": "Malware payload (Mirai)", "value": "548874be004a0cacf50f994535e98099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339920, "uuid": "86360973-3920-498c-8c15-8ea4183255fb", "comment": "Malware payload (Mirai)", "value": "b09d093ad73e09af7abdc999da32f833be82b850c22f8e5c7f85f96b009df7bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339920, "uuid": "1bd0a44f-64eb-4b5e-a6d9-07809053d125", "comment": "Malware payload (Mirai)", "value": "a9eba6b6182366935d05d077cf701e0c715069ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339920, "uuid": "0a489293-ea4a-4704-a3ba-0427b66bc7e0", "comment": "Malware payload (Mirai)", "value": "6610665c295e07deac1634ab0b7a6f2595fb190f6bb40e955e720673c311222b2d984b38b2cba026bf6dbbc758bf80a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339920, "uuid": "1030aeb7-c13a-4897-baac-2918386105f0", "value": "T180741A48B1F1E3EDE164E5715319BE1A4C72463230937287F39EB97363A71804AEDA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339920, "uuid": "f0a19be4-61d9-43c4-a2bd-57720f545236", "value": "6144:za9xa9da9ADuwvJzrMsM2etd1LmFdcOgXOVvt2+UDmYHS:za9xa9da9ADBJ3Gtd1LmFdCuvt2nmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339920, "uuid": "dd6b1d8b-c4b8-4719-a596-9d5acb0ccdda", "value": 356732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339920, "uuid": "474c39a8-50e4-4cf6-8f69-cb8780df77b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339920, "uuid": "0a32a778-0e11-439b-b395-76678e5a485c", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a609695-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371882, "uuid": "e8796364-6fa1-4fe4-ac83-ba839c0035ab", "comment": "Malware payload (AsyncRAT)", "value": "b303d7eeaa7ac464c13b60326047c80f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371882, "uuid": "07b810d6-e101-4f4a-90e0-132e068ba882", "comment": "Malware payload (AsyncRAT)", "value": "b0b0e64cecb0ab90aa114f904328ed4385b6985ff76097e528d02f166d3f78c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371882, "uuid": "76b89f9f-3ac0-4bb8-8c9f-1d19a5596bf7", "comment": "Malware payload (AsyncRAT)", "value": "efbe6ea9783b9924c7509e6aa13085503eeb82cf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371882, "uuid": "23067abd-e167-49c2-83ab-51537afecd28", "comment": "Malware payload (AsyncRAT)", "value": "538b3d099b002f2bb21f22e221bfc38ca55c72fa3e00aeaa9622efa7d2bdea501969810f8160f73f3a3332d01d8ff9d7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371882, "uuid": "3a496d3a-6c9f-4109-84e2-0db8d9f509ee", "value": "T176F412141607F413C554173D49E2F2B462BAAFD5A813D217AFDDBFDBBE227229C402A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371882, "uuid": "1949b1f5-ea14-4587-907e-942924773075", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371882, "uuid": "f9005168-39e2-4cee-97c7-d16797d46843", "value": "12288:silJdbWPQTYq+2y8bQ5SXyaRCh+t7kDWygTdE7wgRs/zaiIgqEbUQQSkN4:si1TYq05laRX6wE0gi7aiIgqEZHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371882, "uuid": "73a2dda0-e582-4dad-b0f2-3bd2474e0c67", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371882, "uuid": "c0121981-4777-4bb7-9222-557bde568cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371882, "uuid": "0550b3a0-ef81-4f36-90b1-6d534865bb1f", "value": "b0b0e64cecb0ab90aa114f904328ed4385b6985ff76097e528d02f166d3f78c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88c23c6-94fa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394052, "uuid": "7df70612-ea5f-450e-bd84-e00fb8397f6f", "comment": "Malware payload", "value": "16915bd782b35d4da8de4e694faf3e98", "object_relation": "md5", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394052, "uuid": "31dafab4-6606-48b4-93d9-17a366e4dd7b", "comment": "Malware payload", "value": "b0c3159483e42c564f54c243626c3f07053474431ef17e7131a205fc33639a31", "object_relation": "sha256", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394052, "uuid": "bb93aa49-6206-4252-924c-03e23a596513", "comment": "Malware payload", "value": "1094fb2d1de8e369c60b75584bb186d725cb54f4", "object_relation": "sha1", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394052, "uuid": "9db0c5b7-7f40-4958-9b6d-169d04eb3dd1", "comment": "Malware payload", "value": "2c9499d5c9928b540368be97551371ee2f2f4d5424b18c4a02733d1c0fa3deb30aeec0b33f061391aa5d7187522ffa6b", "object_relation": "sha3-384", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394052, "uuid": "87212f40-c525-42d9-b236-e942da79d014", "value": "T1FE73E703E2E450FCE1D8C238939B9A37DD31B8C9563469AE27443A122BF7E507B2E575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394052, "uuid": "19556b49-233b-4c4c-a531-520ab427fe17", "value": "1536:F80LU4VjwGLV6N8Zb8vrYxWSjE40HrOGOwhBWOt:G0LUVGLV6N2SYxWHHrZOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394052, "uuid": "d568f789-28b9-4802-93ae-ad0f842c267e", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394052, "uuid": "a192fe09-11d7-4424-82da-855c5afc82b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394052, "uuid": "b9a6cd3e-5aca-43b0-adf1-ba1ffddba6d7", "value": "Kharon.x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb4851f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368931, "uuid": "0d0a84a6-5ed5-4f9d-9428-7bdf364e1168", "comment": "Malware payload (Formbook)", "value": "de54d11a3b83e7d68cafb752cc812ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368931, "uuid": "7aff8731-8743-44c6-90d0-718a64edbcd9", "comment": "Malware payload (Formbook)", "value": "b104c9a214e246c16ca4e8c0cf883d031c27ca628f27905fb4420dd4b9f9228c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368931, "uuid": "2cba595f-4fdb-4dd1-937d-c19f43b163fc", "comment": "Malware payload (Formbook)", "value": "d0465b9294b17842d2a60421cd51e8e49a04c2ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368931, "uuid": "b39bba5f-f2a5-4d38-bfc6-9b6ea080eeef", "comment": "Malware payload (Formbook)", "value": "51fa810d6ec181fc7930121bc0f5719c8217c347c0f52ace9b85ab5d21ebbc4ea8521877b06912d6590fc4d5aa7dda32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368931, "uuid": "c5d31d7c-3f1e-49e7-b4fe-8ca10875f1b3", "value": "T1BB351218124DE402D0634FB84E72D3F55B786F98E932C60B9FDDBE9BBA7B2A21445341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368931, "uuid": "b0214831-0fe1-40d4-880f-c2ba18f39a3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368931, "uuid": "64e5ab81-ba15-43bd-9003-f2a9e7fb8476", "value": "24576:Ya6Uw4XzomTvtmounxCPQfk/MMl2rEbbA7Ps:Ya696EmrtH4xiQfkP+CM70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368931, "uuid": "5371bc74-00eb-4275-8276-87f52aaf2989", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368931, "uuid": "2f6f2664-77f0-4520-8712-4148eaa1a67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368931, "uuid": "9649492f-3a24-4be2-bc82-0f4cbb9b4e06", "value": "b104c9a214e246c16ca4e8c0cf883d031c27ca628f27905fb4420dd4b9f9228c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984971db-94cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786374616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374616, "uuid": "426cdbc2-4876-43e2-a4d4-b483e0fcae51", "comment": "Malware payload", "value": "642b04d715ef1ee7543917269a69e7e8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374616, "uuid": "ce102bb1-5bf0-4e6e-83b7-1574248f23df", "comment": "Malware payload", "value": "b11c0cdc9c16683613cafa148e7bc400990bf9a198637780bf675cf109801822", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374616, "uuid": "68deadad-93bd-4850-b022-307c39594771", "comment": "Malware payload", "value": "e8964ba2c36b68636e102d3967949dcdaf6a55d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374616, "uuid": "e8871e0e-2523-428e-8597-6ced8b36e7f5", "comment": "Malware payload", "value": "54f1946382d1bf3cc0bfa7dee09b95e18ff31c6f00aeacd5b03b929e6525e8746658c111c52f1f56f89ab5edf4ead2fb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374616, "uuid": "1591b87a-ebe2-4365-9e4b-2531c770917e", "value": "T1FC236D6616857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374616, "uuid": "0c506a57-0254-42fd-b042-cb656a024e6c", "value": "768:CXRWNGxVv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ulxScr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374616, "uuid": "32f1446a-0a86-48ad-9072-6cd754db8437", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374616, "uuid": "610a18b9-f5e0-498a-9056-8e7e778ed69e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374616, "uuid": "7ddbdf35-c977-4560-bf73-57f9fafc41ec", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ba569d-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370423, "uuid": "bf1d2f63-631b-48de-8d5d-e99e4f2031cd", "comment": "Malware payload (Formbook)", "value": "8109d3c2be8a5fec58e1fccdec4be37d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370423, "uuid": "ab4a6d52-ca14-4033-b125-e560f05d9856", "comment": "Malware payload (Formbook)", "value": "b12eaf7c0b2179a7f21142a300333eea62d1adf329fb8f82fd97b0cd7b89b10e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370423, "uuid": "2382c8da-3553-46bc-85e7-b4de4c1c06c1", "comment": "Malware payload (Formbook)", "value": "37327b3ae4dc50f14db1d781fb1bdb508858e433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370423, "uuid": "7fa17ecd-5d78-4429-906c-d238711fcee4", "comment": "Malware payload (Formbook)", "value": "c2c147e7f8994ebb522604fe4413d9a105d267f02bb812fc94d2ad3c75a0235f482705abc8f66e6b5a41277f1982949b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370423, "uuid": "1da5303a-0edc-451f-bec3-97629d5fcaee", "value": "T117251258AD28CC22C9C247754A12F77823749D99F421C763CFFAFEABB8685176C189C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370423, "uuid": "771bfec7-4b6f-4b30-880a-8fa1aafe830d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370423, "uuid": "460fc0f3-20e6-4d81-a6e6-7caf61aacc14", "value": "24576:2pKIfftCX8N643hLzNn9iFmb97fLjgYl:2pzfftsMhB9iK1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370423, "uuid": "3b78ab46-4097-45ae-8a34-7176b39ccca7", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370423, "uuid": "f7183a4b-7a7c-4150-bdaf-925a762867b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370423, "uuid": "c220fb6e-071e-4768-9b77-5500120010ae", "value": "b12eaf7c0b2179a7f21142a300333eea62d1adf329fb8f82fd97b0cd7b89b10e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc74868-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371649, "uuid": "37314c26-92a2-45fb-b575-e100c21f8218", "comment": "Malware payload (Vidar)", "value": "bf9f3440f256dd7d0d9502b0d1f3cb0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371649, "uuid": "49ccf429-8393-4de2-a4b8-e9981c84787b", "comment": "Malware payload (Vidar)", "value": "b131e46af90da6e3b8336354f56046e31209b4516db3b12fe34f5c3e5c22f9cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371649, "uuid": "b2a0c79b-0ba3-4ef9-883e-550a29371c9b", "comment": "Malware payload (Vidar)", "value": "9a70dce7b51e310646796929e0f81963f533cdbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371649, "uuid": "6e5bf53c-8720-4f3d-bd4d-7155bd6545cb", "comment": "Malware payload (Vidar)", "value": "dd0a67fedb48ad5cd5886dee62f80009b039b4c74674f8b673ef792fff709ea856158cc3e38533b7b69c55c236437c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371649, "uuid": "bdc0eb8f-d665-4383-8c69-d9298f47bedf", "value": "T113827485D11B52B4C8EBC333A75A112756F8BC412236973BABEC5A324D52370F7682ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371649, "uuid": "2e86385b-6314-47f4-a98b-36fed315f19f", "value": "cf07cb97e4ee7855ab9adf42130a0267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371649, "uuid": "820f814c-130f-478b-b9ab-255e8714e3b6", "value": "384:Ovpsy1q+VwTxWcLTBZ5orwdTkAjQ19VbRwl:UN1JPcn5MwdgAjmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371649, "uuid": "a37b60b7-aff3-4c13-bf3a-63045e1fd729", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371649, "uuid": "3af09e9d-41d1-4a41-b1de-c45863cca4d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371649, "uuid": "fbb776e3-df0c-4cc8-a4f0-fcd4e280ca3f", "value": "b131e46af90da6e3b8336354f56046e31209b4516db3b12fe34f5c3e5c22f9cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cba5672-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371483, "uuid": "ca9b69f1-35fe-4e3e-bb05-e1803e0b6b07", "comment": "Malware payload (Vidar)", "value": "5abadfb9cf157a583af90d6b710b3a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371483, "uuid": "a53f417b-3e27-4088-8fca-a12bd958a0b1", "comment": "Malware payload (Vidar)", "value": "b15b24a16ec78b56b4a6006c47957c5b6848324b79f1da062f41fe95f80e7f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371483, "uuid": "1ca4a9a7-70ce-429a-bc67-412e8870e521", "comment": "Malware payload (Vidar)", "value": "a2e0ce66de456fd1da51f09419da980454b888e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371483, "uuid": "6d96af6c-3205-4050-8655-cfad91fe57aa", "comment": "Malware payload (Vidar)", "value": "5924c47f526caf74b6afbfeb6057e326db5560435d94261e13181036820dbf8a739d349847f726eb30f3f942e9d1419a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371483, "uuid": "10e5ef50-2b73-4884-aff2-696817cd62d8", "value": "T19A823F05E11B52F0C8EFC73357AA5516AAF8BC053272673B9FDC9A610D92330E6192ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371483, "uuid": "c59126b0-bd84-44fc-a4a1-bb820cf5fce1", "value": "a7b132a7e2200369ed45a2bca9e5774c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371483, "uuid": "59c6aee1-a625-4bb4-a307-0fe1ff7049b6", "value": "384:OGWJeZcld0cBXhZpplLsap1P2iHMGnSDl5:mbXZdpP2XGSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371483, "uuid": "427b56ad-1c9b-426c-9bc7-526ab209f993", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371483, "uuid": "28109a12-3201-4f5e-abbc-3eb3480d2f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371483, "uuid": "d0e8b65d-1314-4491-ad06-ce6b3fffc338", "value": "b15b24a16ec78b56b4a6006c47957c5b6848324b79f1da062f41fe95f80e7f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7d94d5-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368267, "uuid": "4142e11b-33f6-427a-9a6b-60973db3c91c", "comment": "Malware payload", "value": "a591f63d36a5f076f8008f95de36dedf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368267, "uuid": "e575b26d-7323-40d0-8e9e-ab549f2145c4", "comment": "Malware payload", "value": "b1c5449240b0dc0e7a5b23138a50ca3837edd2957a305e70aea003d9f3f5610e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368267, "uuid": "96b54141-fb1d-4245-a934-076f8869f621", "comment": "Malware payload", "value": "949fc0b2d70ea691dc09d23c1bf4869d10d555e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368267, "uuid": "68923484-caa8-49e9-be79-2d7593596268", "comment": "Malware payload", "value": "fd2b2f4be0dcf2b0fe17c93f918372d427a378a4ec80c5cb79d8fbaaf22ca31392efdceac5a49124a16086d97b5c3152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368267, "uuid": "22680ad3-e4c9-4738-8e5e-df1c8c0f94b2", "value": "T1F215C01519072707C63D2B79C03B2DD893FBE9435296DF273EEC21E85AAABC1CA87541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368267, "uuid": "611d9a9c-a711-498c-b9bb-3b2a6ae1ed81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368267, "uuid": "61122718-1993-40e9-ab5c-4a00395af55b", "value": "24576:cqfMQoLC1c8/ZwQoZntN9+mMPYldT0BrV+Z2s:x0Q+yc8ebzN86gVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368267, "uuid": "8fd73c79-7fed-40d9-a9a7-756f39854839", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368267, "uuid": "20e469ea-8175-475a-8724-4da3f7c07bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368267, "uuid": "c6611a16-289a-4d85-b338-af376ddfe6ef", "value": "b1c5449240b0dc0e7a5b23138a50ca3837edd2957a305e70aea003d9f3f5610e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb29dd1-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "ab021ad5-6cf9-4c2f-967b-0b2751934570", "comment": "Malware payload (Mirai)", "value": "a15a98362e67d57550852c5350f88cb5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "c267d830-fcb3-46a3-b002-9d37912d4d1a", "comment": "Malware payload (Mirai)", "value": "b1d6f145938c7680b188cac5f88af3d313e8386d593fb2e62e99dcaf92a436d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "f4fa0031-8e95-450c-a0c2-01db2741bb36", "comment": "Malware payload (Mirai)", "value": "7cefb282b67d4e3b1042c3ca5e0bf1f356bd6b93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "92c1810a-0ab9-4d7a-9656-ac4065d1c56a", "comment": "Malware payload (Mirai)", "value": "4cd5248d34ffce4d5bdfd6359d0331bcc45dc849b3267113b3a4d7a2d38d12a3111d08d38a296832dac115eca17bea5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "370e2a91-e8f3-4bb8-a1f7-fa5040f13b43", "value": "T137B3023FE7E6DE40EABC5B3C940E30156010A78B77AB66DD0B6CCD489A3145A2B453F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "f4d35d1b-36fd-43dd-8277-b653ee8dd6e7", "value": "3072:90eb+ePt+S8gSkqt7Qpt2P/UGh4WDkiYh:9r+FSTvqtot2P/U04uPYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383593, "uuid": "25267b56-cb17-4e39-a126-7c027b049422", "value": 107872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383593, "uuid": "abbe9f09-d3f9-4189-8afd-8ee48525b4ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "f257b700-79d1-49f2-bf17-6c41d960dbf5", "value": "disconnectraw.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92e87c8-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339909, "uuid": "ebea39ab-d16b-4829-866b-21accb7e0db5", "comment": "Malware payload (Mirai)", "value": "f0af73fd4c55c0d40f808203fa88ce39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339909, "uuid": "dc069f66-a618-42d7-9f60-ab6fac330980", "comment": "Malware payload (Mirai)", "value": "b1d7843c6e534a0af1fa3eafc20f148529f736ff62f81936995f6bad0cbb9e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339909, "uuid": "0c58c748-d0bf-4557-ae26-18e846e2a5d0", "comment": "Malware payload (Mirai)", "value": "02c34c52b634794f4caba4954fb2ce86c6cc8a68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339909, "uuid": "9cd72dbf-fc40-4cab-8ecb-f1d7925bd33e", "comment": "Malware payload (Mirai)", "value": "1d975dce19a2eb69b72dc66b831b685da7bad26968f4150a5f07145d484d08442cbf549ce68d119a82b183c3c3797960", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339909, "uuid": "5af3852e-5a13-49c0-9bd8-b364c50ed079", "value": "T189742A8862F1E3CEE158FE3553157D0A4DA65A3335C7328A625FB6B323FA15C46EC920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339909, "uuid": "89ead6ec-2ea1-4f6c-923f-205c91815bc7", "value": "6144:Ea9Na9Qa9mf85Bv+Z85qkaJ390HGvXmqa07Mqc9Czk3wG0x8ilQA:Ea9Na9Qa9mvG5CHT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339909, "uuid": "3ce335c2-8cdd-4eea-8617-634f274055c3", "value": 338752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339909, "uuid": "0b8d358a-3bc2-4d4a-ac6d-80ce756d3a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339909, "uuid": "2a2968d5-bca5-4588-89ae-fc4303eb8ece", "value": "pid.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72651dc6-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340193, "uuid": "8937fd04-0531-4539-bcf5-d10231d7b066", "comment": "Malware payload (Mirai)", "value": "109714e5744758e167f6e30e413abb0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340193, "uuid": "c374fe0e-6216-4e4e-a22e-679107aacac7", "comment": "Malware payload (Mirai)", "value": "b1d800e1886a4f28f1d7169cc29b1b0689b2112bd0ad7eae404bed3f79a9c8d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340193, "uuid": "2609b036-7eb5-4546-9fd0-13d850968167", "comment": "Malware payload (Mirai)", "value": "f489179e07ab87aa563d0b3cd28126c0861f0e1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340193, "uuid": "7d1effa6-5036-4286-83fc-748cbca9f929", "comment": "Malware payload (Mirai)", "value": "95f27fe29feb72abe1c81b1219e815f256e84f1ccce6735825b6a7f6947250000b6fbe47e85bedd9dcea216a92e4ddd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340193, "uuid": "560470fc-2e85-4141-855c-983955438a31", "value": "T1D9742A8882F5FBDEE296FA3993147C0B5C218B367083758561AEF96313B72450AFDD60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340193, "uuid": "ffc895d6-2554-42d5-bd5f-03ce47c23f5a", "value": "6144:dV7Qo3fcGFXoEIEIR2CJOLIDs8xT0LFNCTYsavC2ip:TkGFXoa8WiPT0amC2ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340193, "uuid": "1ee670a3-d9d9-4aa5-9f39-9acea8baf668", "value": 365644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340193, "uuid": "03f59bee-44db-4354-bbdd-9a429680790e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340193, "uuid": "3eb1d071-f181-457b-8b27-cc88ca4e0c6a", "value": "vlxx.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb93bc0-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373797, "uuid": "bbac1bcc-248a-41a5-b4a1-ba5bdb7392f5", "comment": "Malware payload (Formbook)", "value": "6cb9744b1f3583cd6a68e2a6bcd2f76d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373797, "uuid": "ff7f6aa5-fec5-4933-bcb0-786ad5d8f1c8", "comment": "Malware payload (Formbook)", "value": "b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373797, "uuid": "f44c6ab7-4a26-40f7-a885-3dbdc518b3a3", "comment": "Malware payload (Formbook)", "value": "047e9b6eabf6151127474b96d1e7616247025bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373797, "uuid": "2e097aa8-aae1-4e85-91f9-280f9cd92de5", "comment": "Malware payload (Formbook)", "value": "eed07dd2228cecd1b1edf4468564029af8296df58eff1a879576b129fbb06fd86ff8e312830d62d9340a9670f8fe2f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373797, "uuid": "c2f1a470-4c09-4a9d-8704-cdf8564c4ec4", "value": "T1CC2523AC76B58A13E9A96BFC46F0E53557723E8F9330D20E4ECA6CEB7461B008914713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373797, "uuid": "b246a0c9-469f-4ae7-816f-b0fff2e9cdeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373797, "uuid": "a2577db7-ed86-4f9d-935d-d9c63ae35ca8", "value": "12288:iHFM19w+pGFSBp9DpoBYBZLG6Sue0WXN8tFBWPFb2iPZUTNR0jnAQLskfxwwLCms:iHFK9xpHBp9DpoBWC6SWGENIAQ7HLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373797, "uuid": "60bc2264-de0d-4773-b548-64a0d7598007", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373797, "uuid": "369c33a2-c0a3-4ee3-b0d5-c687461ce05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373797, "uuid": "26e79ebc-2f22-4b32-a1dc-052bf7e5f2cd", "value": "b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc187ac7-946d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786333552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786333552, "uuid": "ccd0854b-3b4b-4823-8da9-b3a020d57492", "comment": "Malware payload", "value": "af4915939052cb8eba4c7298ecd30c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786333552, "uuid": "1f44538c-ef3c-48f1-af50-e5d051b621da", "comment": "Malware payload", "value": "b28384acb97364f1fe056c8a6c4bcc12b66265b7da1c14e7dce6704d68200438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786333552, "uuid": "0d666eb0-4674-4027-bb91-daa1517d6e25", "comment": "Malware payload", "value": "ad3459975f82095293d67f6fd840d681957794a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786333552, "uuid": "7588c6b4-4873-4d68-939f-10ea40305ed5", "comment": "Malware payload", "value": "1660dcd79b189dbbd73a31f153ac4306abb1209d5d66c9fb22b923379c2a01a3f8ff4630e93cd7f0f0785fbedb27c104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786333552, "uuid": "33109b1a-966b-4bbb-9104-70e92316c04a", "value": "T1FC33D745FA41AB05D5A231FAFB8E414D3317AFA8E3FD312199305FA013C6ADB0B76526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786333552, "uuid": "8fcff58f-dfab-4dee-997c-7332b2dbeb95", "value": "1536:oWnaUUrN6orI5ENB57lsrSlUyzviws2ve6qrISzUL:UUUnI5ENB57dE2veHIS4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786333552, "uuid": "f8ec6087-069f-43a5-9d2a-4baed12765c2", "value": 54252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786333552, "uuid": "6c1d3f6d-f3be-40a8-aa7d-f3be5ca208a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786333552, "uuid": "518ad0cc-af05-4cb7-9732-d5639a978d18", "value": "main.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15e1dfa-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373424, "uuid": "172711ad-27fc-4710-85ec-e99537576505", "comment": "Malware payload (AgentTesla)", "value": "01e298bdc100ec212290064b750fe980", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373424, "uuid": "0e32d3d4-5217-4d6b-87a6-5098e1c542d8", "comment": "Malware payload (AgentTesla)", "value": "b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373424, "uuid": "876124e9-d7b4-418c-96f1-1f362462f4ff", "comment": "Malware payload (AgentTesla)", "value": "8f79e44b8a3b079c07e3da4ff5690c4618fa6898", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373424, "uuid": "0e873514-fd60-41e7-8733-4c9c95f3da03", "comment": "Malware payload (AgentTesla)", "value": "0c3adca36c12eb6a8ee20912a3d18d3002f6295a2d3af4ca9d6c40f31dff0b056460c16624ae1be90d3a266752f40b17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373424, "uuid": "a0be7281-73a6-4671-8f7b-4ca8e97da838", "value": "T1F845F1E4A162C8C1D8D246BBBF50E73071A71CFFB9D0C2419ED96BA375376426328627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373424, "uuid": "01bd979b-87df-4523-a267-6ddc22e264fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373424, "uuid": "4fd445a0-61ca-463c-8ac8-c6a7170ea478", "value": "24576:1LSp50cju7z4J3/+R3UwT0BxxCaztLf6rMjObS9ffr24uGKQrLYf7t:12prS7z6/5SgxvRxj24vKo45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373424, "uuid": "d832b5f2-dcee-4312-a37f-5238c8010785", "value": 1267200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373424, "uuid": "0bedf548-02e5-4730-a485-ce6420c9b5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373424, "uuid": "eb071c3a-6e2c-48d7-bed8-f024dd197f25", "value": "b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b2673b-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369061, "uuid": "dd016a45-0201-4da5-ae3c-7725ffc68f58", "comment": "Malware payload (Vidar)", "value": "98b16a9222bced3f2ff4e53d79c753b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369061, "uuid": "9b44e64d-7fb0-49cb-a474-7dfb90cb1375", "comment": "Malware payload (Vidar)", "value": "b2d069e5e5ecce9367a17b4b7eed4cc303fc6a5a8f9efb05fda7bbca5d9534ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369061, "uuid": "546c1452-c571-4494-8585-091e3b26aa10", "comment": "Malware payload (Vidar)", "value": "67c021e55a9f0f98fb87cd1799cd87e178ef3045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369061, "uuid": "fa0d249d-7070-4980-bbd1-ea211999daea", "comment": "Malware payload (Vidar)", "value": "c9e9ab0cd9241eec19c54397a0cf3f94ce4aaa9024f63b3e1f5120fe61f59cf2162d34b4c8c4a2c98e65cc57c375703a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369061, "uuid": "d7b4a3a1-5765-4360-9cc2-c740a4bd5754", "value": "T161422CCB7283A0F8C098C374CA8F56B9DB1230891B1A4DFF55EC86947FC2211A5396A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369061, "uuid": "4c9db5bb-f124-4225-8a98-aa6109a4216b", "value": "f0e3160a5bd62fbc1af1bbb43e8f6a5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369061, "uuid": "6019c6d8-b0b6-47f0-a3f0-e7f23c58aa3d", "value": "192:O2BdAV5j0kJYPDWqpIXk/uaya56NTfzvrkoWqU4LXhT3V1:O2Bd+0kJoPI0rL5WlWqU4rhTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369061, "uuid": "ef5d3684-ed73-42ef-8926-767b764c65db", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369061, "uuid": "c386f610-0ecc-4515-bff3-b571a1085f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369061, "uuid": "e81b05a4-5ae4-4259-83b5-2ec8e6ca3ffd", "value": "b2d069e5e5ecce9367a17b4b7eed4cc303fc6a5a8f9efb05fda7bbca5d9534ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e44bdd-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371683, "uuid": "0a74c2f0-f5fc-438d-aeda-0124bdf4f0d3", "comment": "Malware payload (AgentTesla)", "value": "987e2d51367c962ca4490946fa5d0493", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371683, "uuid": "d3b427ae-cfbb-443b-b6c9-6b266128b706", "comment": "Malware payload (AgentTesla)", "value": "b2d3b20e69d39d7a4c43e2ee2dd22d7d2063aa85d578cd082aa227ce9f7cdd14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371683, "uuid": "da84f2c2-6867-4425-9399-dc8150529a38", "comment": "Malware payload (AgentTesla)", "value": "b9e36651174e787f37a9f349fd45a255675dc1d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371683, "uuid": "e53fe912-79a5-4003-b532-85fd78f8413e", "comment": "Malware payload (AgentTesla)", "value": "4cc3f14a5ae3358a32e274da906fb04d7624db87a6b942eebbbb15fcd708adceb229c77ce96eab7a01b5ef21888b082b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371683, "uuid": "93cad8c9-6426-4e3d-bdae-ec897b21f80e", "value": "T1882512297755E207C8892B791E31F1B827B86EEA6840E3271FED7DEF7932B014D04196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371683, "uuid": "fb6369a6-c1bd-4250-b18b-68fdb906a5be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371683, "uuid": "403a90ef-3177-4212-bb5a-433dc8741d38", "value": "24576:Cjm6pHKjlNDSZsEIXqTCpRGYxjoiudfePb9nV:WtKjf9L2CpEoIePb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371683, "uuid": "1c317794-16c2-4948-b8d3-179d54f00615", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371683, "uuid": "19d660d5-cd2a-4e95-b91e-4e9ac77e70bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371683, "uuid": "b0d229e2-8781-4a5a-8ad1-6d08c52e549f", "value": "b2d3b20e69d39d7a4c43e2ee2dd22d7d2063aa85d578cd082aa227ce9f7cdd14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc895a8-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373958, "uuid": "45d05c18-473a-432f-9ed7-092bdfc368b0", "comment": "Malware payload (RemcosRAT)", "value": "f3a1dacc4807e595f4103ecaaba1e054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373958, "uuid": "8c7fbd31-9467-4625-b328-662de4cb0062", "comment": "Malware payload (RemcosRAT)", "value": "b314f879fcca552b0677a993d27018645ff4a79967606a35dff9260d35b3391d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373958, "uuid": "512446e1-a018-4959-9719-5af4222922f4", "comment": "Malware payload (RemcosRAT)", "value": "46d171e02d8a261e1411a29e30bd26580e70b01d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373958, "uuid": "fd3a9187-1060-4649-ac01-395621a010c0", "comment": "Malware payload (RemcosRAT)", "value": "005243bee794583c562d816343cfdf19493482627a0eca6e42adadd83940cb1d70f52697fd5fa3c2e7b717d2fa13d476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373958, "uuid": "2300044c-643c-4d1b-b637-450c03fb1e4c", "value": "T13E552388866A9B06F8BB2F760436C27217F65C9D7231C3852FE9ACFB7B837504410756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373958, "uuid": "2448d8a0-919a-48f7-92ee-d453c64db9a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373958, "uuid": "b5b1fd5a-0e15-4fe2-88e1-f65d892b4b04", "value": "24576:7RMJ28eRC3FZOr9AEKW3HiIGQc5pglFe8LrgJE/7bW4lZl0W6YWx5V:1LTYFZOr9AEXiNQcm//7RhOYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373958, "uuid": "d4e7d8fe-8ca4-4d25-aba0-83e24cc2932f", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373958, "uuid": "10d41ba0-1eab-4ba6-a402-bf9de26271aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373958, "uuid": "69cc73f2-5889-4d42-b630-7083b826dabc", "value": "b314f879fcca552b0677a993d27018645ff4a79967606a35dff9260d35b3391d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb25985a-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372554, "uuid": "d9896071-f223-4c7a-9912-740a7bccacd8", "comment": "Malware payload", "value": "eefaf56cee585252e5ba15622d118146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372554, "uuid": "2edbabff-4c3e-428a-beb3-968cc9ce6f21", "comment": "Malware payload", "value": "b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372554, "uuid": "4eab814e-9a5e-4c95-a621-0f2bf6293afc", "comment": "Malware payload", "value": "b4a2ddde5fc7dd8ae5b1bd5a74dbc177dec2b437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372554, "uuid": "7ff1887d-e19c-48e4-88bc-1d5c949f12e2", "comment": "Malware payload", "value": "a90688b228a7a9764843c6bc431c540482efde894f681be9fd57bef11b5358b7d620f055f2c7fc11b7f78092d4b164a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372554, "uuid": "c798fdc3-6886-44f0-ad46-3df58363cf1f", "value": "T114C4F147AB9217AEF8267CFCCDEBC92363617F565564524B0600DE2E78E7490C42BE32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372554, "uuid": "71395151-27dc-4cf9-acb6-c88bd557a59f", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372554, "uuid": "79bbcbba-8594-4536-badb-fd0b2f5fbf15", "value": "12288:170ZdexqurywS6jH5rAo3d3E/YaNC8Nb2Dnqnq5W:17QexbrZxjH5rA+d0/Gy2DnLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372554, "uuid": "79f54b17-638c-4453-bd6e-e177b19ecb8e", "value": 556648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372554, "uuid": "2b3afc8e-84df-4fd8-8861-f1d86fac9085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372554, "uuid": "d1fea2c8-c0cb-474d-baf5-fbcd6097fed2", "value": "b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f49ea1-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395042, "uuid": "0cbe0cc7-289d-400a-9d8e-26b64ff5f742", "comment": "Malware payload", "value": "8d6abaea22e71740c1baff2b058c7bc2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395042, "uuid": "aa51c8d8-707d-447d-8135-672ce5406557", "comment": "Malware payload", "value": "b357bb1f56247a1efe298bbfd5e236606f57a096de25929ee35058f0e4a5f620", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395042, "uuid": "2b99bfed-ff8b-4a3a-94d3-ccbb236b634e", "comment": "Malware payload", "value": "52e791e4df3edcbe3d1f3686036f3db146961a47", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395042, "uuid": "f6050407-95b8-485a-a270-023bc500ba8e", "comment": "Malware payload", "value": "457357885c3f4c52ac69b942018715174e773916b012023d591e641ae3b68a6e5f6d51c3e3a44b7b8c49021b202f92b4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395042, "uuid": "8eeb92c3-eaa6-49d8-b42b-18fd8cc28111", "value": "T134145A0963E91166F4F26B7499F202934A767CB2BB7582EF1780916E0E336C4D931F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395042, "uuid": "43ac7f93-abd1-4875-8d5a-c7c2fb0ad26c", "value": "9da7080b9b697496fd4f41997e8bd436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395042, "uuid": "27e04f1a-292f-43fc-af6b-2c35b4356295", "value": "3072:URLiJRaxQRsgLY1EI5GWp1icKAArDZz4N9GhbkrNEkzfH7YEH6tH:V3axQpZip0yN90QEUfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395042, "uuid": "0b63a68c-bfd9-450e-aadd-3f9da6f7c09a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395042, "uuid": "60cd95fa-2481-485e-bf20-5948da9edb3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395042, "uuid": "684af49c-f8ea-49ad-b1da-aaceb4fd5e70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81159579-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395623, "uuid": "669c2540-d3bc-40e2-bd18-e8a6b509138d", "comment": "Malware payload", "value": "554f35082ce80d3f54d1899494f81585", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395623, "uuid": "0e631637-6b31-4ab2-9225-bc20d5f12a61", "comment": "Malware payload", "value": "b371e0b147617232a4a72ca7607bee2e827a722ba094be5652a0ee7e709114d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395623, "uuid": "4f47d29a-81fe-4fe0-b5f1-d69907b34a4d", "comment": "Malware payload", "value": "64e835b12ede0eae7eab96309cbaeee81380ecf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395623, "uuid": "7e2513eb-ee3c-474a-8d27-1633c87feccd", "comment": "Malware payload", "value": "1a886e7d3c5e921d5637e2d077cd12fae3ed1c777103f7ba976abb66bca30c350b156c9b63a12782e56f0633342f70a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395623, "uuid": "b686b57e-4491-45c3-9505-dc072f4172b0", "value": "T13A539D6AF0D69CF6CC5089B6E472D0300B417DB123DA1D85F85DF2A81B3BA967E4D760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395623, "uuid": "292e7f4f-9107-493a-8bd3-8b1e989cdd3e", "value": "1536:UtYdr7Jtn12aclfvceSxNhshFAedC236Xn0r:pdJSa0vceSDWF3dC2KXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395623, "uuid": "c176df08-9250-4846-8874-7faa89c4159c", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395623, "uuid": "96c53148-842f-43ea-b7ce-d55f75067329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395623, "uuid": "f9e620b6-3f5f-40bd-bee2-649ea844d380", "value": "main.sh4musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360dac19-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356842, "uuid": "50b2979e-7af1-49c1-858b-141806fd880e", "comment": "Malware payload (Mirai)", "value": "816f4cae1961d3a0b8cd3ad569408b9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356842, "uuid": "1bad96ae-e330-47a0-a1f4-0a8c69dac4fc", "comment": "Malware payload (Mirai)", "value": "b37d1bf8dde710cae9095a46505286c689fefa1ef911b0b0709b3833749c6efc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356842, "uuid": "11028378-38b0-4393-8cd4-1057a4cf95f8", "comment": "Malware payload (Mirai)", "value": "c0fdb4f3183c81fd12d231655de5b6458d5e0d9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356842, "uuid": "66830456-111f-4df1-bac5-9145c4c6a416", "comment": "Malware payload (Mirai)", "value": "244a582f7d2fab31dec8a10e1196ab5487d54dcfbea951232e8b2ccd1998e8ae55ac16824165d7aa6335c0c19e0c0604", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356842, "uuid": "719e737e-d0c8-4e1f-9588-c1e8b4f0c972", "value": "T1DA049F73E8256FA8C1A58174B0F48EB51B23969041876EFA66B2C3764047D8BFB1C7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356842, "uuid": "4861a748-f761-4dbe-9b2c-32d704e778f7", "value": "3072:2LzTbQlfkl18lUXNQ/sZEVoWpLr8zpIIc:2zhl18lUXNqzxpL4ziIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356842, "uuid": "a3714b6a-f4e0-4a26-b856-c90b2c130b5c", "value": 180248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356842, "uuid": "1b03cf52-dae0-4f5f-9418-0cd43cd43cd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356842, "uuid": "9bf49782-beba-4133-9580-a3c06b4a370c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7debe0-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786372609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372609, "uuid": "0dc51984-d6d3-42b0-9b6a-71c89a168746", "comment": "Malware payload (njrat)", "value": "9ba9b5e30a963ccc4333645d2a3519e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372609, "uuid": "4a6b0085-4248-4618-9626-f1e2f5a6c397", "comment": "Malware payload (njrat)", "value": "b3904b9f42cb877e8534f96ad1519abb4f3bcb772c38d8ac5e1101fbbd575cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372609, "uuid": "012f5cfa-37eb-45d6-906c-0fabbaf265bd", "comment": "Malware payload (njrat)", "value": "ead16831e232b9d43fe071148e738d20bbe76941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372609, "uuid": "1aeb6081-dc2f-4908-a875-01948ae4c280", "comment": "Malware payload (njrat)", "value": "cb085e5f9bb3ab2bd9f0e6bff2f399074583687c5fc6f71c193c0dc325cd5293140e1bfc7719d182124f67a8eccc7302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372609, "uuid": "a064cb73-bf63-4098-a940-93b7c8c76b62", "value": "T12115F04023A68D52E0F68BF6B8B0D37532A45DCF78E2D2955FE91FFB38253815464392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372609, "uuid": "71a7613e-93d4-46a3-865e-d4231dc806b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372609, "uuid": "a56d8acb-1bef-4518-abcc-9f95db6181ed", "value": "24576:ocIp50Vl482mYC06sbKycdMNki382E+IYm9:ocIpkB2pbWMD82tIYm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372609, "uuid": "60bf3674-24df-497b-9096-88864f0effe6", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372609, "uuid": "2e891222-9e6a-4567-b52b-f04a467e532c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372609, "uuid": "515e8f77-f3d8-465f-8f9b-5cd5e4ac7db7", "value": "b3904b9f42cb877e8534f96ad1519abb4f3bcb772c38d8ac5e1101fbbd575cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9927c05c-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374188, "uuid": "3563dc4b-d214-4d20-aaf7-7b201c9d8e40", "comment": "Malware payload (AsyncRAT)", "value": "6238d7f46c42aa6ee498121a2e271320", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374188, "uuid": "e48ca417-c00e-4337-918f-9b7395200e25", "comment": "Malware payload (AsyncRAT)", "value": "b3c339440028e5a737b5d3a3edfbfe2d353d5362ee8b692666fa08e28d201718", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374188, "uuid": "fc4563f2-ac1e-4ac2-b4cc-b8e4fdaf2980", "comment": "Malware payload (AsyncRAT)", "value": "f727e5362e466e96a773d68179822e602dc73663", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374188, "uuid": "ef3c80ee-6962-4689-bfd5-64fcf896db0b", "comment": "Malware payload (AsyncRAT)", "value": "32a9901aec25aab9c2ba88b60e384b9020a01ea6882385b10222981ba57745d2e7795c41794aca64b09058d86a654369", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374188, "uuid": "723278c6-0e82-464b-8ea3-957d99a630ef", "value": "T19305025C1A05D513C9906B785AB2E3F8173C6EEDE001D3279FEDADEBB96BE104D10292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374188, "uuid": "64332e7d-c846-4362-abdb-88891b628fcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374188, "uuid": "004a2ef7-37e6-431c-abf4-667863c628d8", "value": "12288:r8N7m+4wsasWaxyqilf2tKZe5jUSObf6vfWDGY3iSQeR2d/9B6:r8NP4GsWaxyqiN2SepUAWDGGpQeA9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374188, "uuid": "0bee8f39-b19f-4f53-baba-4c2de9ce924e", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374188, "uuid": "3378a633-df8a-49f4-83c0-35efa94e3716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374188, "uuid": "2c33dce7-6db8-4531-b260-d22eb2775f9e", "value": "b3c339440028e5a737b5d3a3edfbfe2d353d5362ee8b692666fa08e28d201718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c126289a-94f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786390147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390147, "uuid": "4f9c9ba2-a4a9-44c7-9187-d0de3195bac5", "comment": "Malware payload (RemusStealer)", "value": "c9570e0950ceeaf6331d24b2f35197d9", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390147, "uuid": "02cb7fed-b4bd-4dc6-a5ec-1385193130f0", "comment": "Malware payload (RemusStealer)", "value": "b431762c4d8a0a25d9a210bbfdfa302c2be3dca39121cf10ede9575332b63ffc", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390147, "uuid": "b39acf54-8bb9-40a2-9c5e-45a7362e8ca0", "comment": "Malware payload (RemusStealer)", "value": "e1e3dc7c6a021f8d4b018ef7600c72d325bd9ce6", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390147, "uuid": "a423704f-f1b5-431f-a99c-32481bc27890", "comment": "Malware payload (RemusStealer)", "value": "10a711af940516dcb823e514e6b61aa5bae020b6bb3c085264f9921278aef7e552f1954a842c4561d1bcdf5b2586e9b1", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390147, "uuid": "87188b1d-6e51-45c0-b63f-25f151b17653", "value": "T15F262817A99148F6C199E736C4BB5615BB70B80D4B3123D31EA1BEB82F323D16E35B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390147, "uuid": "a5ae463c-3a87-41a5-9580-5ab8ff92f148", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390147, "uuid": "9e8c421e-b4f8-4170-a3a3-cac2ec22735a", "value": "24576:VM3XNEsIgtLZxWpszVkDLhocDoFnZhaDG3/FeRtr0qslVTYA3Y7TFlfJBele5r91:VM39nIMxLZCFornvaSURiY57/x84rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390147, "uuid": "ffc3f6cb-de21-40c1-895f-b85126c9520d", "value": 4618096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390147, "uuid": "e5df52f1-d459-4428-b1df-501f7ee5ac69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390147, "uuid": "27ecae1b-8ad6-4de2-841d-24782320c622", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2705c4b6-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373567, "uuid": "4c4dec9a-929e-4f02-bf14-eaba0fdd927f", "comment": "Malware payload (AsyncRAT)", "value": "68fe5f9979c95034cf0596660fc57755", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373567, "uuid": "a83c780a-dc09-4431-8569-41b0668ce92d", "comment": "Malware payload (AsyncRAT)", "value": "b4750e372bc14d6f6e4d2281d09c55a392d54a0abc71893c09c9c50b3390bd59", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373567, "uuid": "2006474b-d429-4be7-b37f-add0c39b04d0", "comment": "Malware payload (AsyncRAT)", "value": "6845009b578334673176ed44486253f8717d391f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373567, "uuid": "abbebf6f-4304-4092-b896-d5d6cecea926", "comment": "Malware payload (AsyncRAT)", "value": "29f2f856f938c29b78c60c276d500b82cafd5a4f5eaa5b5ea91141172a02b3fe38e8f4e3358b0dc84417d689fedfc4a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373567, "uuid": "7a5edac2-3110-4fa3-a3e6-a4c3c7119c68", "value": "T11005E02815679606E4B66FF00E71F1B0AB7D6DAAE231D61A5FD60CEBB56B7003C04327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373567, "uuid": "fae0196b-2187-41d8-89c1-c6b653393b0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373567, "uuid": "d294f616-d919-4523-a00a-52e57e9cc1ff", "value": "12288:UxPeToq/uI/DyvwQRBu9GFH3sPLXcjSqJi3/QwH2pvqx/rVDghuuSn5peV:UxPS//u9ZFXMr8Z41H26BZuSn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373567, "uuid": "fcb125c0-e0bc-46b9-93f7-13e85e195e11", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373567, "uuid": "c7e9b804-728d-4844-a07d-e0843864c67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373567, "uuid": "5274a180-7096-4795-ae1a-47f0b231aac7", "value": "b4750e372bc14d6f6e4d2281d09c55a392d54a0abc71893c09c9c50b3390bd59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88da2461-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370725, "uuid": "a4ed964a-9225-486e-b373-33d246c9ff06", "comment": "Malware payload (AgentTesla)", "value": "f66272264d10d2496d53e7842c754277", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370725, "uuid": "1acd3b71-c3f8-48b8-8dbd-fbc6f19b70a4", "comment": "Malware payload (AgentTesla)", "value": "b47e77c436e304af3d334162fe84856fe04baae80e66498db6d9ea024db372ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370725, "uuid": "4f07ec46-a82e-4a26-af75-20b9caffb06b", "comment": "Malware payload (AgentTesla)", "value": "94d6304d30a35704a8cdf0d7e0679e3fe064c31f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370725, "uuid": "db433f74-b954-4070-a32f-cff11abf61ae", "comment": "Malware payload (AgentTesla)", "value": "d02c0c8514656ab50d0386e4f5fd0787379a36beaf86154e27be7f8d3c5a235c859cf2463c9246b27d4c7cbc4124b037", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370725, "uuid": "fea2df7e-8a26-430c-9af6-8d8b7c554e31", "value": "T17B94BF13F694C596D81112F04C7FD8292263AD7898A3560F3EAEF73D6EB3292F11714A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370725, "uuid": "1fd3a95a-5290-424d-9ae2-c68f985ac03b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370725, "uuid": "ac03593f-5fd6-41de-9ff8-6465287cc0f9", "value": "6144:iTA8oPSCIjV6M1H+s9pe1RssAQvwZwdfKKCSoQv7OVGlWkmYnu+jhiRy:iTA6VLd9Y7qQvwZwuyKV4mAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370725, "uuid": "89e2dc1a-e308-4770-b73a-15aec1f55934", "value": 447224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370725, "uuid": "1f88e916-d01e-40f6-b821-6c66576ba0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370725, "uuid": "135a5e7e-d5c1-426d-b765-c46c1efe4ca5", "value": "b47e77c436e304af3d334162fe84856fe04baae80e66498db6d9ea024db372ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a507bc80-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786369054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369054, "uuid": "a1e5cec1-dbd5-456f-bc4a-1d7d31b3429a", "comment": "Malware payload (XWorm)", "value": "0505bd66de051dbc2bc1abc304dd6b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369054, "uuid": "c47bd51a-9c3f-4b19-abb3-256e51baa5e4", "comment": "Malware payload (XWorm)", "value": "b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369054, "uuid": "98c9e883-df7b-450c-a02f-b168ca33e77f", "comment": "Malware payload (XWorm)", "value": "6ef8f93a174a2f5895e3775f9aadd956bc4b1e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369054, "uuid": "d2550220-fa50-4ded-9749-19052b4f4046", "comment": "Malware payload (XWorm)", "value": "555bd780fbfc9945ba70375719c26d2896973456630332ce2ecce259f6cdc08cee61b7eef9e2a6924a09e8556554ee93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369054, "uuid": "02c86e56-f2fd-4147-be69-130eb27158b7", "value": "T1BE1501652369CB06D4BA0FF95971D2745BB46E88B932E20B9FE57ECFB83A7900500353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369054, "uuid": "dff2e7ff-1816-4139-9dc8-42efc23ea112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369054, "uuid": "f482bc9c-7e45-4c94-baa1-f65465881a5f", "value": "12288:fga6QlwEasmCS6O3GEftXHCvH2noa8qDJ/VZjwKE2RbndZGpnDnoyyqTlwV6:oa6Uwzsm1FXyHDatPUGRb2hDnFyEuV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369054, "uuid": "59c3631f-1966-4284-96ad-02561a5bb1c3", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369054, "uuid": "78de89c6-bb38-4b44-9b60-e2d0d6f81e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369054, "uuid": "18cad48e-de62-47ab-aaad-98562d6ac14f", "value": "b48d01ebe4284502001c7e487b66732adf986d38eeefada174ffe068b7f288eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad4afc4-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372232, "uuid": "91097891-c69f-4d4f-a6cc-5771aa3cf966", "comment": "Malware payload (AgentTesla)", "value": "8a35f27c6722a9ef4696c9b23be13cef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372232, "uuid": "b8180157-3a21-4c39-8b02-347a946187fb", "comment": "Malware payload (AgentTesla)", "value": "b4d1bf62935a6bf2712c9910da6e437f4dfaa52bbca5aae7c871a7c105a65aa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372232, "uuid": "f4078c42-a94e-407a-8bf4-0133f294d9d5", "comment": "Malware payload (AgentTesla)", "value": "d26a957276a3adf6089c5b7364c7e0f251887281", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372232, "uuid": "c1a96839-e655-418b-86d2-2658ed63e507", "comment": "Malware payload (AgentTesla)", "value": "bad0c2f86ef6f1c456e9ca22cc05e4153f22d979e963072f0fff11552502242d9268531541632036c05e2d5c06c2ac05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372232, "uuid": "4fff325e-da4f-434e-8e36-97a5c1879c28", "value": "T1FF25233293B1EA16E5B107F409F0E23483795DADA430C65B8FE6ADEFB81572418987D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372232, "uuid": "b71ee639-cbb9-4724-893e-9f14bbc551b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372232, "uuid": "3245ebfb-2e1c-420f-bf6e-85e122ab4b46", "value": "24576:gj/Og3KLGMSJuZxdESQ9TwTGYmKtlyHdQk1QHoQDq3ZOg+t:SP6wQndU9oGytm68IqEg+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372232, "uuid": "bfecbc70-cd5e-4930-809d-f2d481b9daba", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372232, "uuid": "4ad6d9e5-ade2-46e5-bf2f-b856cf2bc5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372232, "uuid": "866fd1ef-6ec6-4f95-8254-a2c562c76297", "value": "b4d1bf62935a6bf2712c9910da6e437f4dfaa52bbca5aae7c871a7c105a65aa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a9833b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371446, "uuid": "8c2fe4e7-16bb-42ca-89d9-ce1ccbbdcb6b", "comment": "Malware payload (Vidar)", "value": "73eda2ae056ace133ba1b17ab0259792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371446, "uuid": "fad6832c-51e2-4ffe-b1e6-069db855f8ec", "comment": "Malware payload (Vidar)", "value": "b4d6dd10f0dc9ad003137e526929066bb17ee2b735fcc431002d1941d7a58a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371446, "uuid": "3900a4fe-a716-4952-9a4c-ba48a4360585", "comment": "Malware payload (Vidar)", "value": "726e7f2d5491f5404f2794c3034811d935226456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371446, "uuid": "963f1648-9f19-45ba-9197-04edbed7c600", "comment": "Malware payload (Vidar)", "value": "dc2041527540d141e5f5e25039458c1928869bd4d75dc1f3d9661c340a82cc1a5cf0ad9ecbd088b539ee80946bc32c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371446, "uuid": "39ac1edb-e86d-43d7-8f56-07c74e8b62ef", "value": "T12D926345D1176AE4C4D6C733631A56A764F8B86032329B3F9BEC6A7A0D92330A7503FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371446, "uuid": "29be9de7-3a52-4924-aa40-01170e117084", "value": "9e59872e7b02a2d8c2cc19db69feafa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371446, "uuid": "13d6c421-17e0-4dde-9dc9-04954d05a349", "value": "384:OlsaQ8bnDUb2iMYN9Z679oRPKOhUhV/RNhwvyTUTYYl1:a+3OjRV/5wnTY+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371446, "uuid": "6f6d5011-ce7a-4283-89f5-c17309556211", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371446, "uuid": "8728971c-81a7-4944-b32f-b73353dd438e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371446, "uuid": "ad636596-795d-4b23-97ae-a97f1b10bff4", "value": "b4d6dd10f0dc9ad003137e526929066bb17ee2b735fcc431002d1941d7a58a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cad152b-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371832, "uuid": "39bc4b1b-cf57-481b-b8d3-5ad188ebdd72", "comment": "Malware payload", "value": "bab7132fde71234aa70af7be82a47d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371832, "uuid": "4b44fd26-43b3-4da6-9ba6-f58202d734fa", "comment": "Malware payload", "value": "b58e98e5b5ee5eca5fdb1f154af6da4a40e32f55b3b43792f3cd363371176d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371832, "uuid": "c5dc1e1c-e3dd-4073-ad80-8b53887f0dec", "comment": "Malware payload", "value": "61f33ef24da2eb931660acd4d398697726fa10ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371832, "uuid": "43061573-3568-43f6-ad4f-c3311879c99a", "comment": "Malware payload", "value": "f4e394466049a8db8b1ef606c9b1f007df33ff690b7a4d9e34ea72122b365175c9b51a35f786602363c5dc3f34ad8d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371832, "uuid": "93f6cd49-477d-4160-b9d3-f4bd05c4bb0e", "value": "T16A25F19C3511F58FC813DA728DA4ED74A6251DAA9707C213A1DB1DEFBA0DA97CF040E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371832, "uuid": "6451c1e9-377e-46ad-ab65-447d779d1227", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371832, "uuid": "c1cdac72-5a7e-4dd5-bb93-e146d9762f6d", "value": "24576:H6weyDRhVaYihWvGYRgqO4M62MAaO9LOu234cp:H6we2R+YwYM82MAxLOuKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371832, "uuid": "2a48af13-bea6-437d-b238-338546a308e4", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371832, "uuid": "45ddb68e-8d7a-4083-ab8d-69cc5b5a0892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371832, "uuid": "1b0f4979-dd07-4d33-843e-6bc722648674", "value": "b58e98e5b5ee5eca5fdb1f154af6da4a40e32f55b3b43792f3cd363371176d87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b739f9f-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404633, "uuid": "140fecdf-8269-4227-96ea-ca62efce107f", "comment": "Malware payload (Mirai)", "value": "32835fa46362f85d68d6d95cad40c3a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404633, "uuid": "adf7392b-c206-41fa-888b-21a299905929", "comment": "Malware payload (Mirai)", "value": "b5ca5ab2333aa186807dd398a0f666bd8ab39fd88606cc0942084a7c9bf68afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404633, "uuid": "c3bb9841-0e26-4ce6-9440-5d95d453e740", "comment": "Malware payload (Mirai)", "value": "55f0a70e1a0619344bf63a721c7777786b08578d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404633, "uuid": "72eee2d1-0229-4008-b316-63ba1c94db7b", "comment": "Malware payload (Mirai)", "value": "c98c301bc0c8de666ed294c25b973bc915175dfd14b1e16877c4812df4f5cb580d2deb2233c86ad02787119440e6268a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404633, "uuid": "2c07b8af-724e-4fd0-94e0-c7992b12e007", "value": "T140532A4B73118F91C769DA3002F34A536BEA12A327D39406F36DEE516B6234D681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404633, "uuid": "24db933e-cb29-473c-a252-c9092772b071", "value": "1536:9dpAU2p+mvIFYOv0uNCuh7VBf0VpBb1ka:P2U2lnOvT3Fib1ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404633, "uuid": "9ffbac19-0a5a-4692-b66e-754cd3119195", "value": 64812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404633, "uuid": "709bc77c-fca8-4f09-b1ee-ad9c35144350", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404633, "uuid": "763dbad6-6549-44a9-9188-6b63eee60ae6", "value": "mini.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1c020f-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371532, "uuid": "ff1b1b4a-a24c-4170-aa6f-4e8da3538330", "comment": "Malware payload (Formbook)", "value": "20cadb603115e1040cd5ad4b73a3e391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371532, "uuid": "4cafbe61-eea5-40c2-89db-82de69ba5c32", "comment": "Malware payload (Formbook)", "value": "b5ec2bbf0faff9ac7cf5d88dde412fde80300322dcaf1d8555be0413b112b4bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371532, "uuid": "c976eba7-0e1a-4c49-994d-1fcd26a598f5", "comment": "Malware payload (Formbook)", "value": "2eab878cf79764fd0669994f20733ea5ccf0d90f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371532, "uuid": "63db8fb2-4b35-411f-a111-56e3ad9e721e", "comment": "Malware payload (Formbook)", "value": "7b45d0c58c2673417c5aa1d38c23b303f3391fb3afe91efd9ee4b630289ff0f2979411e844c4cefc51f8a3d95192f4a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371532, "uuid": "0c2e45c4-92b4-45ee-a815-fab4fd70565c", "value": "T1BB2523C4AA82E603C55407790B70F2B667BE5CF6B410D7369FEEBDEBB4619085D081D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371532, "uuid": "e236c94c-94da-4b4c-9100-d166663e97e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371532, "uuid": "80de674b-9e93-46c8-ac69-10e25b51008b", "value": "24576:vmdnw4uUBdcP38EpL0/pTxuzFZtRBL5ClB:vmdw4uUkP38EJwzuzn55Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371532, "uuid": "d0a85982-167d-43a0-ad61-b0bfc647a348", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371532, "uuid": "881ccbb5-806d-40eb-b21d-859e4d1c8605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371532, "uuid": "d84e6d55-689f-41f6-949d-2ccb8500304a", "value": "b5ec2bbf0faff9ac7cf5d88dde412fde80300322dcaf1d8555be0413b112b4bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d21e102-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373524, "uuid": "de4ca171-fa64-43a0-9297-0e4fbc67119f", "comment": "Malware payload (AgentTesla)", "value": "7439f17d92c38fc731f67ed35eed193c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373524, "uuid": "e99321d7-b859-451e-ade4-8331ab5a5a06", "comment": "Malware payload (AgentTesla)", "value": "b615eab43788b8f293b05d046d745fd02a3c18c5c34b9e6a509f188e4c50e17d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373524, "uuid": "a494130c-bf76-450f-be18-09a1aaebbaa3", "comment": "Malware payload (AgentTesla)", "value": "c4a0d863ba33a17baf788436edcc7e237b8aa597", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373524, "uuid": "4592944f-a023-4fe2-95a6-461b120322d2", "comment": "Malware payload (AgentTesla)", "value": "508ce7ce48c83527c3043ddc6ee4ae4630ee451c77727c8cee851c5c7dacb33d234e42973c771b61f8d0277017be99c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373524, "uuid": "e6f98e55-fdb2-46d1-9a33-4bad3529f1bd", "value": "T19A85023B4CC755A1D1A88E7893F914EC23F0861B5252F7AB2EE603F4CF1175E66271A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373524, "uuid": "7f3dc123-63bc-4424-9d86-673ded51ab13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373524, "uuid": "0cd751a5-d0b9-48d0-95b0-f3cf0c093f58", "value": "24576:BQ2d07VES6WanbpA6d8agynZ7t8K7fhkWj2hGUNlerBlRqHN9tayLVXfDbV:BoiSQ6yZh/kbhGml4qEwXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373524, "uuid": "173be6cb-499e-4a42-92b2-2327ebbb95ea", "value": 1790976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373524, "uuid": "6383b55b-86a1-4769-9484-d3ffc62459e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373524, "uuid": "9a76d33b-7089-4aac-bcac-288134bc8c37", "value": "b615eab43788b8f293b05d046d745fd02a3c18c5c34b9e6a509f188e4c50e17d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88483224-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372442, "uuid": "f0380575-9748-45b2-9e82-c05e2469d313", "comment": "Malware payload (Formbook)", "value": "13136a04d87f92e94ae15f27465f0d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372442, "uuid": "3d75ee7c-e02d-41ca-88b0-b26714400a0a", "comment": "Malware payload (Formbook)", "value": "b6854c596563e0048566fe854441ff5085c33bd180f5812c4de360723ac4c41c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372442, "uuid": "43e49d3e-5138-4bed-b068-e9eec0830cf8", "comment": "Malware payload (Formbook)", "value": "54dc94e1e8940ced41b494084aceadbde7bea147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372442, "uuid": "1e358682-e0f6-41af-8e2b-299c2319ee06", "comment": "Malware payload (Formbook)", "value": "3931610a4381e7d6bac4b5287b5d4f61ad514dcb1d526f1ab8a01049a7969da4b6150a210f7cd0d3a9a7a1ef28ca9438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372442, "uuid": "c7e09850-d497-4fb1-bdbc-f0e4211cdd71", "value": "T132351254B6A7EE02C2A40BB50DE0E13017B49E4DA533C69B0EC84DDF3A69BD94ED4793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372442, "uuid": "f6aa9b56-e0b1-4ddd-af1b-debe304e9487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372442, "uuid": "c8d5e6ac-06d6-4c0d-959a-f2c86985d4f8", "value": "24576:fGj/Og3nDzN5KbvUvsezDvXSdmVM87VD108K:fsPnbKbsUezDvX/687x10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372442, "uuid": "164cbf9e-43a1-469a-a196-712c7a16592e", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372442, "uuid": "5d4ee691-46e0-43b6-b248-380b18764dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372442, "uuid": "e2e8e0e7-8e2a-4685-9dd0-babd1fefa146", "value": "b6854c596563e0048566fe854441ff5085c33bd180f5812c4de360723ac4c41c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2a6243-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383590, "uuid": "a43947cd-4ed1-4ffe-bbea-8b6dd8293b20", "comment": "Malware payload (Mirai)", "value": "e9b483eb4a3e3086715fd9fad3517734", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383590, "uuid": "0539b60d-a677-41e2-b224-778a701d28d5", "comment": "Malware payload (Mirai)", "value": "b6906b5ed54dc37806e819174ee78e11aee8ae0cf3d804079607b6f85ca3653a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383590, "uuid": "becd23c6-5de3-4f0b-b280-abb173d5ac61", "comment": "Malware payload (Mirai)", "value": "2bab32bd72386f1c07cdfaa3b25246706407a51e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383590, "uuid": "6b69863a-933c-463c-9a16-592c874397e2", "comment": "Malware payload (Mirai)", "value": "33842fa6ab1c51241db97b2462f5dcf4c5472e94accd16a372a71b7119401ec026870db1a9940870687b7081d65167a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383590, "uuid": "87294536-e3e8-43d7-920b-f4dd95a55759", "value": "T134F31995F880DE62C6C52BBABB5E428C33231778C3DA7102DD145F3977EB95A0B3A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383590, "uuid": "90ab43ea-ae04-4b17-b455-3f6f29bd3c8f", "value": "3072:lx9rJEulhJXs8hppPi/O5WapS7zOmet1NWv1jQ2v91swJk:lx788hppPi2EP7zOmet1mz1iwJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383590, "uuid": "b7391515-e146-4ac5-a27a-0fa76237aec7", "value": 169624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383590, "uuid": "c33715b0-e952-4d68-b4a3-b56a11291404", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383590, "uuid": "e5f15a95-52c9-4fc5-9d83-0764cbb6d91d", "value": "disconnectraw.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1bd5e7-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368286, "uuid": "765cea58-cd1c-49c2-b034-2df658881729", "comment": "Malware payload", "value": "ef269189626c496f45c8019362f98498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368286, "uuid": "b6ab7cd5-9988-4437-b7de-906b89ef7a91", "comment": "Malware payload", "value": "b6bf83e3fb39190d3ad46e216bfac0c74d6c29c0bc1522df56b5c709c24fcc74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368286, "uuid": "031169cb-880b-44e0-bc1b-08d7aa67c97d", "comment": "Malware payload", "value": "2da449c062cf0ee5dec37460d8fc8ad78fa8295c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368286, "uuid": "be11b424-7b12-44dc-9bd3-ab64dba35f1e", "comment": "Malware payload", "value": "c653cc436f30ada70ed372da1b1b49c2e4c5c476947b63c7e77f467f988ea0b69e0acba6f36feaae2fcd04cd40e6af6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368286, "uuid": "a677f2ce-610f-4150-8ad3-48d247dd7649", "value": "T12A65F6C733A401BFEAA6DD7686128507F6F17F0D0262861EC6607F75EE3E6E1162E211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368286, "uuid": "271f6cec-ba29-4951-a20f-1c9ee0468b1f", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368286, "uuid": "42209aca-be76-4b37-b7c8-4cba85a385af", "value": "24576:QCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNre9:L1H4jR2TYrQbDTre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368286, "uuid": "fbc4ab5a-93a2-4060-a418-77792b461ca7", "value": 1416704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368286, "uuid": "89b7eaa9-6bd7-4e2d-9fd1-77e8bdb775cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368286, "uuid": "1610e4bd-d4f3-4f2d-8d10-e95cc68f1588", "value": "b6bf83e3fb39190d3ad46e216bfac0c74d6c29c0bc1522df56b5c709c24fcc74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a26bb0-9489-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786345163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345163, "uuid": "405fb78b-f032-4250-85ee-f1d8b3f66746", "comment": "Malware payload", "value": "c03fb534078da3956d884f44e1ef27f1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345163, "uuid": "739dd2f0-09ef-40ce-9dc9-42204ccd2ca4", "comment": "Malware payload", "value": "b6d4995db6dbfef9cc84dd7dedc42d6988b6f3c68f47906177b9f43d50947d75", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345163, "uuid": "ec311d14-91e9-4a70-abd8-747ba58df75e", "comment": "Malware payload", "value": "34e5fa9c56c2d65e967fa67c54cca51798a3a0e6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345163, "uuid": "881b8ad7-0908-4ea2-b4ef-da12993ca924", "comment": "Malware payload", "value": "ece7e44340e377903d82acd68760b9de466e6df1daaee0a33468486a06000249b9d2591ec2eff6b8a83756cc89338941", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345163, "uuid": "2d4d322d-347d-4886-92e1-bd6b0a44a18c", "value": "T1ED3206CCAF9063F4F29303DD67AF2999132961CB544CDC80F64C6DE06F4B68D4A56E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345163, "uuid": "1a7bedde-9189-4290-990c-4c7ef7e06bd4", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzqlX42AiYOpzfMaYqZl9CX:sXX+/DV7k/3qlLAiYOpzEsT9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345163, "uuid": "99ccd59a-f254-4a0f-9554-64908cb40573", "value": 11988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345163, "uuid": "7748d8dc-b65e-4b81-87e5-646143c54392", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345163, "uuid": "58e6df12-f2f7-45e6-8cb2-79d33886fd09", "value": "ttt.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6791a313-9483-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786342752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342752, "uuid": "04103f9d-af52-489e-bbae-6180774c2c33", "comment": "Malware payload", "value": "1faf9c8dae70e13d3b27ccb7d1b13f2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342752, "uuid": "633d9340-ff7c-42a6-ab03-3c2eecc0e034", "comment": "Malware payload", "value": "b6ec6bc4a7e335bdc4f6d6760c091252be0b6b66dac62a62883fe0330c9684f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342752, "uuid": "68533851-ba58-4101-a638-f0498bbd687f", "comment": "Malware payload", "value": "00d09768332a7cd97ea6929ae30e59d57cbae1f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342752, "uuid": "29e497a2-549a-41d1-9a19-b685bd8aa416", "comment": "Malware payload", "value": "1531a21a610904ce3965c07cb56f66d9b61f51979ebc712ede5164c4c6fb287be94c44aaeb6d17e536738fedc2c9a532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342752, "uuid": "89359902-977a-4711-b4ef-2f7e3df19dc3", "value": "T115230898F844D635C6E071BAF61E42DD33030FBCD2E631159E21AA317BB79194E3BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342752, "uuid": "bf45db3f-61c8-4461-9eec-4fdec46201f2", "value": "768:Zra9hZpIk4PDmPxFWKkUbwsJOccpvWf5L3tuwO5/icgUzd7vQbsU9yY3/eLRlMnk:ZraTZ+TPKPxFWKkUbwsJ9QufR3VOZicO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786342752, "uuid": "26cc0b72-e00e-4518-a727-91473a7135e3", "value": 45968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786342752, "uuid": "ddf62198-3232-48e1-b1ae-48f8e5ccfb19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342752, "uuid": "a1853b3f-e26a-40e0-9802-5fa4a0c65b4a", "value": "main.armv6-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0eeef22-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786368618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368618, "uuid": "f3549b83-78a6-491d-9ddd-39e432b7570a", "comment": "Malware payload (PhantomStealer)", "value": "ac79676bd3711405b5a2a29d13755120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368618, "uuid": "40898704-87b0-4194-ace0-8d5cde4a0e90", "comment": "Malware payload (PhantomStealer)", "value": "b702cd9138799be52084b2ad29adcc10d5499eb5702183137dc0b7845f7acb9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368618, "uuid": "e13a6463-fc8a-4354-ab10-1c0cb7d48d17", "comment": "Malware payload (PhantomStealer)", "value": "fe046bde16c5dd6e93e3b9055f3df9bfb4cf74a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368618, "uuid": "64ab6ee3-a7b4-4db5-8dc0-8e250037f64b", "comment": "Malware payload (PhantomStealer)", "value": "fb0097ee461966702b77df5aac9602bd1080daa35b095a900761d6aeec9486c074ef69bf284ba565585db1db7054d907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368618, "uuid": "7adb4e25-f142-4d7f-a1d2-51e3d0c072a0", "value": "T11A7512C43729A705DEB86A349135EEB813B62E28B420F9E76EDD3B97756C3015D18F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368618, "uuid": "bed9959a-c019-401f-b872-37e3f74637e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368618, "uuid": "891ff954-d2e9-4454-b181-ebb22972b283", "value": "24576:uqGRvQVLrD/LvCqO41KUuMHcooEayNR07FSwG7EydYJ8QQUG4sENIUm:uhRK/LaqOBrMHczE10Alu8LUG4s8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368618, "uuid": "5d923594-384f-4196-888a-e049f1c99245", "value": 1593344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368618, "uuid": "e33d9a35-4df0-46a2-b9c1-210efbc23491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368618, "uuid": "e370f10d-f081-4e42-a095-f03f820e872d", "value": "b702cd9138799be52084b2ad29adcc10d5499eb5702183137dc0b7845f7acb9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0802c3-9499-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1786352106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786352106, "uuid": "8a4d6a64-6233-405e-8791-4b6d061a93c8", "comment": "Malware payload (DCRat)", "value": "092821e77feade246a230168b2c0b775", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786352106, "uuid": "e93bccf4-b7d5-4fe1-82b4-6e69b767f032", "comment": "Malware payload (DCRat)", "value": "b752cd26bfd88495e011ca4ace567f6715d1323bab0803d47b2736cfbc5db955", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786352106, "uuid": "d59a5012-a6c2-4d79-bdb2-6a6ab5d50e8a", "comment": "Malware payload (DCRat)", "value": "5fcb20277dab30f4ae6a46f9596d68d2cea74609", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786352106, "uuid": "d70608fa-c35f-4bf0-bf2b-c627d9b6cba6", "comment": "Malware payload (DCRat)", "value": "bc44aa853d54c5e4366161a93c0d0ab19ad9ae17f63697346ecb9e12e8fa13ec54ab435bc001658f15caeca8246c2ebe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786352106, "uuid": "e9a986cd-c76f-4c27-89ab-9d3a3ee4ed5f", "value": "T1E34559027E48CA92F4181277C3FF45044BB4AC106AA6E72B7EB9376D56163937C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786352106, "uuid": "22867740-9a54-4b10-9946-25c2886ae0f2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786352106, "uuid": "300f7f35-3ec0-4963-9744-19a39b85d1f5", "value": "24576:U2G/nvxW3Ww0tfj3hgKhumRptFtW1p42K6N4Yl:UbA30b3hg0R86M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786352106, "uuid": "d88be7c7-2b2a-4a81-8ec5-6df6fe329812", "value": 1164898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786352106, "uuid": "e98cd492-0e46-420d-955e-23d3c7feefb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786352106, "uuid": "fb0a7c26-014e-49f1-b494-c4c256f184b4", "value": "092821e77feade246a230168b2c0b775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32eb9732-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371869, "uuid": "4b08c119-0fad-4db8-8411-1953f3266838", "comment": "Malware payload (AgentTesla)", "value": "af258fd42d343884066c5c437fd8ef1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371869, "uuid": "b15c2016-a367-41d5-85ac-97e9e837eac0", "comment": "Malware payload (AgentTesla)", "value": "b7935b10112af47c8ac317f07c37b4d5b458fffe288f76067917574a00cb69e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371869, "uuid": "4098c2f7-67de-4c74-8169-2b4a2cacebc9", "comment": "Malware payload (AgentTesla)", "value": "fe55b5e5888b4bde2d8d76cffdaa844337fe5063", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371869, "uuid": "1d8647cd-3225-49a1-b98d-2f5561693ccf", "comment": "Malware payload (AgentTesla)", "value": "9e2468244008840aa2cfc4ce873fbebfe30ff9037d16ef3269e2f7eab955927ce649e2b4d2db931271f0da9be45c1b64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371869, "uuid": "83959059-9438-4da0-8cd9-e3b069eec7e0", "value": "T18135DF651A428A09EAD1663249F2D1702167CF6E7900EB067BC47F8FF539259D4B2F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371869, "uuid": "7015ac48-2934-44d2-bddc-b88dbbdb9aa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371869, "uuid": "2741f584-7c55-4e8a-a4de-45d27b64eb54", "value": "24576:mpBgWMIlUhAalnYC+28L9uFU06JKYq3/x9or8IaJ3s:AgWjlUHlnYCF8LwFUJBq3J9m8IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371869, "uuid": "ff057635-39c2-43ef-9659-6425d786f440", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371869, "uuid": "7f9ece92-3a6e-4177-a733-1c6a1c64ee96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371869, "uuid": "206b2c31-cea8-4fc9-abff-0565361fcb12", "value": "b7935b10112af47c8ac317f07c37b4d5b458fffe288f76067917574a00cb69e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd1aaa0-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368960, "uuid": "a25d11ee-c131-4405-99ee-7280edf14c4f", "comment": "Malware payload (Formbook)", "value": "bd6fc5f35bcdcaa5d7701075922e1ee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368960, "uuid": "78255a2c-0ed4-4cee-a264-f588531fa7cd", "comment": "Malware payload (Formbook)", "value": "b832538a434413b245b3e1833f10eb7897edb9f878cdde45aab81b4971714a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368960, "uuid": "893c53b7-29db-4e63-9bb9-f668c77fffd2", "comment": "Malware payload (Formbook)", "value": "b732c78f3e6890b6aff0c500d2a79a9c44c61e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368960, "uuid": "537f399c-4b1a-4ead-a1b0-5415301a6a92", "comment": "Malware payload (Formbook)", "value": "1ce4a4f1ddde98abaa7416c1dd219895b2757c29a1f38179a155e3229f353914df4c4901985fa12d18a658d6b1f489f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368960, "uuid": "46a707df-41cf-4a18-8287-0749163c1121", "value": "T171351228265DD807D4A60BB10E31D77867245FCDB522C247DFE9BDAF72BB3A12881391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368960, "uuid": "ca49dac6-51b3-484f-80f5-cbcf003c4ce2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368960, "uuid": "53fd8b28-887b-47f8-a84f-9aae9006bdce", "value": "24576:KPa6Uwu6z2gcGLfsm74y5ZlAb2xvXtWkAOGEw8bkRLSiz5Zh:ua69Bz/bsm/5ZXvXtWr+aSe5Zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368960, "uuid": "a8b93528-0f64-46ac-80ef-65ec54e302de", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368960, "uuid": "2bf108df-dcec-4969-93e6-2fd1fa7f7def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368960, "uuid": "99e4225a-3bd1-46f0-bd70-c3da7ee6c0e3", "value": "b832538a434413b245b3e1833f10eb7897edb9f878cdde45aab81b4971714a03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1244de99-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372674, "uuid": "4d524a03-968a-4dda-a25d-bb1b1ccb6113", "comment": "Malware payload (Formbook)", "value": "88f7e82663075d8126690dbd3378e9c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372674, "uuid": "d8e3b492-f957-4919-bd84-2932b48640a3", "comment": "Malware payload (Formbook)", "value": "b85afc737af13453abde05dfdb3d72c17cac123f8bf92a6aeb5296eb698f52bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372674, "uuid": "3e5bf7ae-3958-49cb-8366-78735d5a4ade", "comment": "Malware payload (Formbook)", "value": "dd09404e7786e752f07fea8c5409cc02692bed2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372674, "uuid": "af8e39be-c386-414d-9a1d-4fdf5248b29e", "comment": "Malware payload (Formbook)", "value": "4a5780aa8293e24d22a3815a06b7a1814e9c721291059c9974dabb8613a10463ee192295d556b1a41881aab9698f6e25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372674, "uuid": "f8e8fbe5-4695-40f8-9821-b9ae368ebacb", "value": "T11F35F1141316DA02E0E687F2E871C7B032B94DDEB9E2D3975FE97FE7742A2C11558282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372674, "uuid": "7b945f52-ea59-49a8-95d6-0ef454af4a08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372674, "uuid": "e06d1907-03fc-4536-902c-c35bdfb5d49f", "value": "24576:Qyip8q/tFwjpJp0Ld6IauEBzFDpxF4AMMMiukMmlp50:bipX/tFsJSLIIaBRD791Melp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372674, "uuid": "8e33a757-e543-42fb-ad41-098a103cb28b", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372674, "uuid": "7dd81ae0-becc-4e5f-9cd5-9677a13484a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372674, "uuid": "15f6bab0-6a9a-4b28-a4e9-cb0de31503d6", "value": "b85afc737af13453abde05dfdb3d72c17cac123f8bf92a6aeb5296eb698f52bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb37c42-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368342, "uuid": "ed1ba6c5-3427-41d3-836b-5d80d628cc1a", "comment": "Malware payload (Vidar)", "value": "20f23a94db71c899a28ad02ffebfb3a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368342, "uuid": "3ff7cacf-c6b7-487a-9a40-94391a8b0572", "comment": "Malware payload (Vidar)", "value": "b8929b32f598feae58a7fab2bd7c289b136c0c9d80125d56a340a4434b961052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368342, "uuid": "8d3cdfbc-968d-4d7f-85f5-262e87af3b1e", "comment": "Malware payload (Vidar)", "value": "65e1c58d4f7b3186029b7f1aa33cc7bb46fda0f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368342, "uuid": "8d2d19ab-3fcb-433b-a622-6efbc0525dff", "comment": "Malware payload (Vidar)", "value": "644a87fa602ff8455516fd5c61cf00c8a24682d5974b588da22b6c34091c6487d63191f8c9783973dc9fddacf42428db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368342, "uuid": "294505f7-da4d-4529-b332-5015884a710d", "value": "T10C82A445D11BEAE4C4DAC732732A165326F9FC2022315A7F6BDD267A0D42370EB542EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368342, "uuid": "40c09072-ef58-4239-97ee-abe9a2ad6595", "value": "a6be3657b2c81c475a0f2fb959d5653a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368342, "uuid": "bd7e21cc-55c4-4748-9bfd-efbb345695f1", "value": "384:OAqGJ5hiDj66iocj7An+6S67NNpDvHowKslO:3c6oaA+6S67VHowKCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368342, "uuid": "8c3d6991-f742-459e-94a5-747c61a736ef", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368342, "uuid": "8a3e51cd-e365-469d-ba67-b8d16a0da2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368342, "uuid": "fb5d0fac-f6c1-4833-842a-fde8dfbb250c", "value": "b8929b32f598feae58a7fab2bd7c289b136c0c9d80125d56a340a4434b961052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb791df4-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Tofsee)", "timestamp": 1786368260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368260, "uuid": "c2f0016b-701a-465c-a895-dba20d3e58cf", "comment": "Malware payload (Tofsee)", "value": "18d658c3544cb06d4d284f17818ca1b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368260, "uuid": "26fe98e4-076a-4f6c-975f-7d371895b3ce", "comment": "Malware payload (Tofsee)", "value": "b8c6984174610bbc4acd359c2795ea2a7ac311f886056da26b277481303f38e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368260, "uuid": "6f036d3d-ef4d-45ff-8d2f-2f1795b6c30e", "comment": "Malware payload (Tofsee)", "value": "ad0f2f734756473de983f4ccdfa9009352677b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368260, "uuid": "c1f21fe4-9c75-461b-b7d2-bcae84325939", "comment": "Malware payload (Tofsee)", "value": "223d26d0ed728bd3d16c8ff919d34794cda9eaeee8344228d1faed0fa3f9b62658d14659c1969f2de85c3f03e56896c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368260, "uuid": "1b0da954-acb0-41be-a2cc-e60ad6000f2a", "value": "T146E60133A28A653EE06E4B355A72A110983B6E616C138D4ADEF4546CCF3D1703E3F697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368260, "uuid": "45301823-11df-490e-98d5-9b0b5df46a59", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368260, "uuid": "c2d9ad18-a5c4-4ea1-baa4-de7e878851ad", "value": "98304:rAX7Y5BSjtYFtvozX1INGSADcEGyQ2jPvRk:iEBGqtvzN7ADcEDjPva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368260, "uuid": "19134888-0100-4101-9922-f7765fea02e5", "value": 14509686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368260, "uuid": "1813aadc-096e-402a-a132-045509de829a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368260, "uuid": "cff7002d-27cc-4d8a-a731-383e9908fe53", "value": "b8c6984174610bbc4acd359c2795ea2a7ac311f886056da26b277481303f38e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0b9c01-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786372370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372370, "uuid": "8c699dfd-ceea-46e9-b5b0-087325f19804", "comment": "Malware payload (Mirai)", "value": "de3ae2dba91c165a93409f71b111c54c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372370, "uuid": "12ba1d24-1d7e-4731-b635-e7631c7b287e", "comment": "Malware payload (Mirai)", "value": "b8ed83d5af70152a34278c2b80d4a8b27e2932e23bb8b6a64ca5f006b7e3c0c4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372370, "uuid": "50e58a67-2473-4ab8-83c7-e93fc6cb1ded", "comment": "Malware payload (Mirai)", "value": "19f01ebb2ad5fdd8e46d6bdbc9610ffda9f477d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372370, "uuid": "ad77528d-2ac3-425e-99b0-caca972ef81c", "comment": "Malware payload (Mirai)", "value": "b95c5e5a2d86b99219e9af7b08fa7f2d0a931b283023d4bda8ef5ac0dbe09d4e3a2134803cdddcbaecf18dca47de3a8c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372370, "uuid": "2b6c7cde-354f-4f88-80ee-55bd00cc1f1c", "value": "T1F6A1A08A3170D63DA86FDDBC3AE50E40988945E235B13F395EB00DA37C89970B349E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372370, "uuid": "f0276bd6-21a6-4fe2-9f18-84a9f895a875", "value": "96:jlr8Vvri1Lx564AH3BojP4jbyA6Hnx44QddZSlBSLITA//iVXPIzF34jxyPfdcnH:jlr8Vvri1Lx564AH3BojP4jbyA6Hnx4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372370, "uuid": "e67322f0-26f2-4996-a566-549a3a16c3fc", "value": 4725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372370, "uuid": "2917f437-4904-4709-994a-30bb16081243", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372370, "uuid": "82eb0e6b-0102-4f76-8d51-36cc3279e0b2", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73bcdc2-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372601, "uuid": "88351389-aeab-4dca-8de0-5114cd6e0578", "comment": "Malware payload (Formbook)", "value": "3391b7efb4d1378cfe3b9bad9f77ecac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372601, "uuid": "e37a48c6-3d13-4bf3-a719-cb9545d1dd5a", "comment": "Malware payload (Formbook)", "value": "b8f189fa37b1081c1000176b613af5c519784ee10c0bda2f5b8f2ae2c06536ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372601, "uuid": "6cc2b029-af52-4ab7-aaf6-173742c94c1e", "comment": "Malware payload (Formbook)", "value": "2af5d5369d7cfe0d5303bfcf45a0e7f65da2b7ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372601, "uuid": "cae8fedd-021f-4df0-97fc-f8f511196e51", "comment": "Malware payload (Formbook)", "value": "695d5f5905e86665abeb1661285e1aa9c09ff5f04d5a756299ba4ddf54aa2dca142a31359aae3cc81734876162bd23a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372601, "uuid": "75b13abf-5c72-42ea-81dd-045b2133508b", "value": "T12135F1141366D942E4E68BBAE8A0D3B433B44DCFB9D1D2938FE97FF778293815914182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372601, "uuid": "5d43f2db-12bb-48d6-b152-6a8e9e2ce167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372601, "uuid": "59bbed87-c283-44bb-a0a6-bbf93d546ba6", "value": "24576:Kp50uql3kcmNUMnq7S9r9zvGJrlYQJhn1Sh/Ry8OQ7O+Xs5:KpuJuNUMq7S9r9zvMrfih/Ry8OQ7O+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372601, "uuid": "4c43c50a-5117-45fd-99c4-a34c0f573d37", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372601, "uuid": "b318fcd5-4583-4941-86e5-6bac559ad49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372601, "uuid": "ae484ffd-669b-42f2-94ad-001d33f9c3e3", "value": "b8f189fa37b1081c1000176b613af5c519784ee10c0bda2f5b8f2ae2c06536ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73ddc06-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370803, "uuid": "ae408c23-ecc1-4e46-93c9-baf14b32e0f4", "comment": "Malware payload (Formbook)", "value": "fe4b789daa30a9ff044c7c4143183668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370803, "uuid": "c3795866-52be-4c76-88e9-3cd176f3ce7c", "comment": "Malware payload (Formbook)", "value": "b8f5fe4a55676ae983fe25c61db681cf62412425c278125382734c9803284411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370803, "uuid": "2563beef-affd-4f18-be3a-5eba2dcadcb0", "comment": "Malware payload (Formbook)", "value": "dee0b5bae371f9e3c6c67055577f5ddd79862afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370803, "uuid": "83b3adf5-b9e7-4e2f-a70a-a8ba8b87e14e", "comment": "Malware payload (Formbook)", "value": "fe088b05cc32895216f621b1ae773bba96fa73c5342819724571b8a0595b04225037fed53b238701d1a690b65ba329de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370803, "uuid": "adafaee4-f2fe-46dd-9824-58f1fdb59563", "value": "T188350248235AED07D9924FF01EB0D3B415A94ED8E415F3138BFABDEBB47A2867C45281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370803, "uuid": "1eedfac2-183e-4d6c-a48b-0be5af13b847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370803, "uuid": "7e178e7f-f4ff-4552-be4f-429c232229f2", "value": "24576:B9N1pSnY0WZPJAHREqDd/i39S1XAdCCP6pvUcsoDNLYR6pF:BanYR9WRQkm6pv7DOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370803, "uuid": "a254ec43-7940-4ea8-86e8-7546d3379c55", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370803, "uuid": "0e13c072-606f-44f2-8ec9-e0460b92b059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370803, "uuid": "d4c11590-810d-4bee-aa6c-ca9a1a8c3926", "value": "b8f5fe4a55676ae983fe25c61db681cf62412425c278125382734c9803284411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d191b09d-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339923, "uuid": "122672c1-0137-4504-a0d3-6fa193531d8e", "comment": "Malware payload (Mirai)", "value": "aedb3e7b5811aaf4a016ec9c71101d03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339923, "uuid": "70c2c1a2-5c8a-4800-b023-ab99ed1ada17", "comment": "Malware payload (Mirai)", "value": "b911fc04045e1ef42d78e2e078d0ab89f82dd83a6dfce2c285f353f7278fe2f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339923, "uuid": "7cea062e-d7a0-4176-890b-b5317d895965", "comment": "Malware payload (Mirai)", "value": "5aa333e582db080da50c1c5c6f3f821fae7c0038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339923, "uuid": "cb9d968d-603b-445b-9e89-186ec798f656", "comment": "Malware payload (Mirai)", "value": "0f6a038a47ddb65c7d998775c545b5869c0eff738d7cf604342bf736737ae0d90a8e9eb97f214fd47bd3f5141e8aca1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339923, "uuid": "656817cd-59f9-4d50-8a86-41b35abdaacd", "value": "T1E5845B8452F1F2DEE298EE7463117E265C620E3730C77186719EF6B312A72445AEDEB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339923, "uuid": "fc9560f1-7fb0-47ca-b3c9-be851e9a6878", "value": "6144:wa6wyU19k86KiFcc3IuzK+rb+Bgn1/t/VrSu+WveNUtA:wwO8HiFcc443F/t/V7vcUtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339923, "uuid": "bc8af300-a51d-485b-9447-683d977a1de0", "value": 390516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339923, "uuid": "e6318eea-99a6-4bb5-a4c7-3aabc3fc9113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339923, "uuid": "1fedaef7-4154-4fcd-8ce9-87332e125b03", "value": "sh4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af7d07f-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369333, "uuid": "2ed289b8-600a-4537-a461-51d533b6ab22", "comment": "Malware payload (Vidar)", "value": "0f163b2306a98442808e716e04b8348f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369333, "uuid": "3185e568-f4c4-404e-ae95-fe8946d10fa8", "comment": "Malware payload (Vidar)", "value": "b97d12c2c5ea39c9b1c78e4e39dedab6bf24221c4069a24c4bea766c5417878b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369333, "uuid": "150d5aa1-5646-4a6c-88de-178bee63074e", "comment": "Malware payload (Vidar)", "value": "7876031d8397fc3b190a8b8674a714ba4d4d4ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369333, "uuid": "f4664f44-fce4-47e5-b49c-077a3d829321", "comment": "Malware payload (Vidar)", "value": "fd6e3d39d049807428554093ac6c8e46300a941c63926195a62b2990ba3d581c333905ce9280abe8daa516e42586c0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369333, "uuid": "a09c0e41-da07-4b35-b76c-09c6b387d698", "value": "T1CB52F88B71C2A0FDC25A837DC66646BBC6703080274E7BFF65ECC594278724079AA665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369333, "uuid": "806f4348-1ed8-4897-be05-1f446b508f50", "value": "1698a6a005ae0011efd0d9c12c6b461b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369333, "uuid": "d38ce34f-20bb-47db-9215-8f5835d4808c", "value": "384:OQZR0Ry2XCgMtum5YQXsJAX6LJKUPWABsblOryG:VBEmOaLCWcuOrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369333, "uuid": "b0bd34f2-5b85-4d3e-b54a-d893aac3466e", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369333, "uuid": "6abf36b7-66e6-4a96-a62b-95f342eb0c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369333, "uuid": "0fdd5cc5-1af0-4773-a426-98c5788a78a9", "value": "b97d12c2c5ea39c9b1c78e4e39dedab6bf24221c4069a24c4bea766c5417878b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae380e06-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786369499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369499, "uuid": "4b86002a-87a2-4ae0-acd4-71d44a94a777", "comment": "Malware payload (GuLoader)", "value": "57d1675f67e36a1345cfdfd7360952ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369499, "uuid": "f0be82ad-b6f8-4a63-805a-2666a125281a", "comment": "Malware payload (GuLoader)", "value": "b99e00a3217634f918e586818a51d7cc409e71deee345727f9dbb9450d3ba7fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369499, "uuid": "edddf963-d8c7-4ba9-8bf8-a608d56d5a39", "comment": "Malware payload (GuLoader)", "value": "575cf09531a7328626f6ccfdbe3565f7dfbb93c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369499, "uuid": "07b2fe2f-da60-4c9d-b5f1-996809ece2ca", "comment": "Malware payload (GuLoader)", "value": "6f8ebcb96217f5d9699f07bf90fc16c90aebda788b78963bdb10018ee9a90773eadec1f7ea1afcd10c4c698ab386dd39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369499, "uuid": "e147911e-ad96-4bfd-ab80-f74d2549c131", "value": "T103941261A3F4C453C93A4A30E8BF99F19FADEC64C691864B6308BF5D7D373524D1A222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369499, "uuid": "8685b82e-7054-4829-8f21-9ceddacdd359", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369499, "uuid": "995c1f35-0704-42b4-bae1-d15f05e2ae02", "value": "12288:BX4nKSZ3LzY/YVA5VvBl/Icqcodqwl+iIBwix9a:B4nKSZbzY/EmVzImo8MEwixA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369499, "uuid": "c668591f-e8fa-4d74-9475-352ab6c69b4c", "value": 415176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369499, "uuid": "64a87389-1074-4f68-950b-63642fe32c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369499, "uuid": "1a2277b4-4091-44dc-b8bb-8209826dd9da", "value": "b99e00a3217634f918e586818a51d7cc409e71deee345727f9dbb9450d3ba7fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1fbbb7-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369633, "uuid": "30e00622-f2eb-4403-873e-8d2766bd2fb4", "comment": "Malware payload (Vidar)", "value": "e6d1193be7a13cc655a3b51fbfed29b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369633, "uuid": "efcf1155-abdc-4f47-833a-db7b23c95c59", "comment": "Malware payload (Vidar)", "value": "b9c2d0d912b35f50063c5fc094f240d738fa49d156c980cfbae3423f9045d6e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369633, "uuid": "c01f099f-da40-4f21-814d-3aaee7438e33", "comment": "Malware payload (Vidar)", "value": "bf6f5768822a925aabadc741bfb8001494d26529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369633, "uuid": "85f3914b-d29c-49d8-bdd1-bfb1408ab839", "comment": "Malware payload (Vidar)", "value": "2952d3f2253f8eef4d2a5aad764c0cfa1ed8fe7a65ae06fec87b73d696cbf9b4f6b9777ded4a7b8fdfd5fec5d46f70b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369633, "uuid": "9198ecf1-adaa-451e-8538-d737b76a2c5b", "value": "T1735208C7B193A0FDC2B8C379D74A02BAEA7270C902254FFF56CC91153A4125169B9BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369633, "uuid": "ddc08a81-2c36-4dd7-b59a-843b04d4036e", "value": "bbf72071f26f7c46646f8d9c633a4529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369633, "uuid": "38c611b3-36c1-42f0-8aef-7619d7853f5e", "value": "192:OruNRQjpUKUhmKBtnuTx1xpqdA5mbOrokBr0dNLo3V1u:OrYRQjWxcKBtQrIdamSkor0jol1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369633, "uuid": "0232680b-1553-4801-a471-47b8c3080577", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369633, "uuid": "b2a0f65c-1302-4744-bc5b-5ecd1c6247b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369633, "uuid": "9b5aa9fd-afff-4fc2-b8a9-b819b2b3e30a", "value": "b9c2d0d912b35f50063c5fc094f240d738fa49d156c980cfbae3423f9045d6e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d76f3f8-948c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346547, "uuid": "c035fb38-457d-48db-aca5-eec17a869774", "comment": "Malware payload", "value": "b920f0f3b7ad9d0faf0a55633d2b6421", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346547, "uuid": "b1988296-8e60-4ee1-9991-b41abf8b8eca", "comment": "Malware payload", "value": "b9ef80b369d4dc304b8a5586125f9cd8fd66828690ffc2e1327c32daeb9319f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346547, "uuid": "8f71f928-710f-4d38-a6e1-ebde6bad48d7", "comment": "Malware payload", "value": "1fd5288bc9052fdf99dda52468d8ea61aaab8f25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346547, "uuid": "6c06b43f-1d45-465f-a4d9-4465d941c23a", "comment": "Malware payload", "value": "41b397eb883e94aaed998457fc98d395d2064056357c870e41f14ec64efc4a58d4e243b392b43de2abc7570e5d03886a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346547, "uuid": "ad6fb629-e453-4ffd-bd0d-afcd1384fd2d", "value": "T12A4345292A22EFFEE56E823047F39E70975536D237A1C244E26CC7085F7024D689F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346547, "uuid": "066703f4-290d-4dd7-861b-2b29d6739e54", "value": "1536:DtXxV9Vezft9NSktb0Wzz0oUU3SUPST6UreDv:kwTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346547, "uuid": "b49351d7-e250-4d72-bdac-42011bfc9a5d", "value": 59592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346547, "uuid": "b9481427-af4e-43ff-8657-cd31040ded2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346547, "uuid": "243dae05-90ce-4361-a08d-c2fffec3889c", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e0455d-94ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786387960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387960, "uuid": "700e38b3-cccf-4db4-aba0-3ce66798f209", "comment": "Malware payload (Efimer)", "value": "3f42345e1eb342864102da72213e0ceb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387960, "uuid": "40dbeb47-55b0-4e42-9c23-c4a54d4b629e", "comment": "Malware payload (Efimer)", "value": "ba36eff6e8b31951f9e306c5f1838ef4634712b9d33b4855e2b0ea4472868393", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387960, "uuid": "451a69e2-1ffc-4ef4-bfaf-65927e99628f", "comment": "Malware payload (Efimer)", "value": "ddc341a6f3f79e0a4ccfa156bb861e9c5f109d7c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387960, "uuid": "2d375e0b-f349-4a0d-a2ee-28ade8b954b7", "comment": "Malware payload (Efimer)", "value": "bcb696f0f1f0e3faa4677c73044bb6a4e265fa4cecfd5bdff5ca57020db2cbaa9d9e13e53f42e8f7b51c3c6f85e6cedb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387960, "uuid": "5137549c-dc1a-4be2-92a5-deb861f34021", "value": "T119E6334469E506EBE9738078EED24691F934BD295375CAEF8778429B6E432D00C3DB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387960, "uuid": "c7e15eca-c1c4-4cf1-8463-17bb64ba1f40", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387960, "uuid": "4a39ccb2-2a43-4ba8-a34f-6812cedb7031", "value": "393216:y2JW+jjHWBqocm0PhqPZ1XMCHWUjccuI3/PGTAI:y2c67WBq9pqPZ1XMb8JH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786387960, "uuid": "0668aa42-ef7b-4b20-8a77-63a2ce620eaf", "value": 14068222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786387960, "uuid": "b85fa5ed-1ffb-43ec-9766-6b5187e63e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387960, "uuid": "e29e9734-ac04-4f32-b7e4-8bf317147337", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3344df-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786395452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395452, "uuid": "0d044cf2-a4ae-48f1-b161-2f9a17116ca1", "comment": "Malware payload (Mirai)", "value": "0f8a039366ab210610f6a1f01235b9ef", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395452, "uuid": "51547445-e781-4a1f-90ed-6d63d4dd6c80", "comment": "Malware payload (Mirai)", "value": "ba41968dd4cf19ed79032bbb68e2a387224b65fb813e69bc49692a4ba09fb4da", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395452, "uuid": "587ba1c8-9f0c-461e-8f65-de72d3843171", "comment": "Malware payload (Mirai)", "value": "a28e614561488706a89e0748faa71216b0587280", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395452, "uuid": "379eda4f-fc28-424e-be2b-75d9fcc7700d", "comment": "Malware payload (Mirai)", "value": "c5199477269e98d5f3a09b5af1e551ed3c384759dd03008706d1dc1476668ca195633d949601d756116d4c1eb56c6836", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395452, "uuid": "de7b0f62-b64f-4426-aacf-79460af0020c", "value": "T1F00423B4E06B92D2C1B7B1FC8BBB830CEC109FD7595C35454424B1A48A997ABF31A9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395452, "uuid": "c3ea21c5-a58c-4f82-9640-c29be4be0a9d", "value": "3072:6JnVo1Muc2fON8OebiQeUmLNkFw9o1DV5G4K1qdeT03EB14Nq1E9q7PnSr6tph:6FVo19ONr2iQelo35GP1q3U74w1H7nc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395452, "uuid": "79c44eff-97a4-47f4-8708-41de81aa19d8", "value": 185896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395452, "uuid": "33098de3-3e83-4bcc-a4a2-0573ae12f9c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395452, "uuid": "eee57f89-a110-49b7-8a79-4cb98c000c9b", "value": "rxwp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e2ebcd-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371041, "uuid": "b104daf2-b24c-4787-93e3-5522eaea40d8", "comment": "Malware payload (Vidar)", "value": "51b33c6480c068f16d9fe2645290e1fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371041, "uuid": "7994eeb6-a62d-4913-ad81-d4ca9ed02551", "comment": "Malware payload (Vidar)", "value": "ba52546128758b2d8efd7972d7dd2c4b35f5a64778f48801ede47634ab49316f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371041, "uuid": "f48d418c-cbb7-43c9-8c95-3fb740651dd4", "comment": "Malware payload (Vidar)", "value": "e167306b8d1b0bc747095ccc53b8d1c6e472acb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371041, "uuid": "dfb28902-4d03-4950-9330-244377f718a7", "comment": "Malware payload (Vidar)", "value": "805bcfacb6ef1feea2de2a0f128ad1499656e12539893954955f93862140adbbf3583a67336b0e5cf91aa16424e28f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371041, "uuid": "cf854a6b-190f-4d97-8e39-59b3f9b9d4c6", "value": "T13A42E85671D3A0FDC5B9C238CA8E12F7DB22708A07095FBF15DCC6C4BA82A6155BCB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371041, "uuid": "b1b46514-a75c-450b-a45b-7dadfb639b5a", "value": "e67138f3b688a80df749778d5f51e34f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371041, "uuid": "fdad6d32-3566-4434-8d29-892a884d68a0", "value": "384:Oa9EUo77KBK3VZticnVfcI2HPltkVCwlcqMt:R9EL7tticnRKdtkVCwlcqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371041, "uuid": "617df4a3-4330-4cf2-87ae-063f416866f5", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371041, "uuid": "2f25679f-b180-4af8-81e3-566c0ec0b3c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371041, "uuid": "53ac47f1-af40-47ba-a45f-841d13894446", "value": "ba52546128758b2d8efd7972d7dd2c4b35f5a64778f48801ede47634ab49316f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a377e202-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371629, "uuid": "8e9284fe-99e3-4d64-aa2c-2c5079b47225", "comment": "Malware payload (Vidar)", "value": "0872c5f6d56c356dd1feb1b0bf76ab5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371629, "uuid": "4efd54b2-102b-435e-811a-6bef7d95f8e5", "comment": "Malware payload (Vidar)", "value": "ba6753b2d119ab1f919c545298a20d2ddb32ffa21f1094d5f058f7bc622af1bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371629, "uuid": "6e2d6417-b10f-4c2d-9e35-9b7496e12ec6", "comment": "Malware payload (Vidar)", "value": "25038309a6b5379224f7a05b79f769d2a95ed6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371629, "uuid": "d3f54c80-c02b-4804-9646-568606c8e3eb", "comment": "Malware payload (Vidar)", "value": "3af76709062d294cf6750721ab310842565fb858e8100b4affbc793043631db8b919c106a3339e83a0617737644ff899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371629, "uuid": "052fc2ea-6a7d-4dbf-aa3c-608de3892a53", "value": "T17142FAC631C3E1BCD259C1B8DBAF02A6D7183085171E9BFF05E8C1986A83542B93CA6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371629, "uuid": "1cf44ff3-dee1-4f2e-952f-56f38e38e9f8", "value": "ef909859c6c6fe160e6e5feb29e2a43a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371629, "uuid": "996dc9ae-d9ed-4b20-91bb-4bce7dac16f3", "value": "192:Ok838FxXvozPnjwvpmnw23k/VjGpwvI8VSkJ1tJEAhK4f6a61zm3Vr26zatser:OwbfoDnjwhn/VjXvI8EkfEAnya61zmlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371629, "uuid": "91161ca4-9e0d-487c-aebe-de1478093c92", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371629, "uuid": "ab8861fd-ae06-420b-8486-122b41646f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371629, "uuid": "03d30b06-aa3b-4890-a9ea-a2d66c57329f", "value": "ba6753b2d119ab1f919c545298a20d2ddb32ffa21f1094d5f058f7bc622af1bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da637b8-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373766, "uuid": "0ed06bf4-e483-41fb-9600-b8baa643a796", "comment": "Malware payload (Formbook)", "value": "e558274d0802d83649187c76c0e69cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373766, "uuid": "037eb585-9664-4b3c-8c83-ad13e31ce34b", "comment": "Malware payload (Formbook)", "value": "ba90ce18dd03a8c6c51f608b926dfc27bb89af9eeb611be9b36592c81652dc92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373766, "uuid": "4e633eb6-ff95-4b53-a014-a8539a37e851", "comment": "Malware payload (Formbook)", "value": "b8442bc82c75522887b2cdb68a98d29daf58b6cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373766, "uuid": "d0c39788-b401-4368-a66a-ca1111f0c500", "comment": "Malware payload (Formbook)", "value": "70268ce343ed339c0366fecc31299049c65aaa131c74ba4980f2e6d0b1c20acf307fe2deb9671f83a573c4c8717ee1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373766, "uuid": "d89b8542-c622-483c-b8bb-16dadde70048", "value": "T1FC2512952B619A13E2B72BFE2875D13017BA3DDDF560D60A8FE96CDB7861B005D20B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373766, "uuid": "c989b5e9-5031-440e-94cd-15b98b717b6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373766, "uuid": "cf8400d6-7419-4377-9c45-805c4c7a36e6", "value": "24576:lzXOJTaJuPUAz6N1AdYjKnsnM6/4CewAnpQeRV6oGVQ:RXOFWuPn+NyiQ6XenpQqVvGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373766, "uuid": "8de31973-6a13-4645-a567-fc0034ac6ee9", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373766, "uuid": "c13290e2-5fd2-49d2-89dc-eb9d23ccc9ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373766, "uuid": "e3cd86db-8b7e-4890-be49-c135c889fa76", "value": "ba90ce18dd03a8c6c51f608b926dfc27bb89af9eeb611be9b36592c81652dc92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da422b35-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373868, "uuid": "0179009a-3cf9-4e88-8f53-cbf50c0058d5", "comment": "Malware payload (RemcosRAT)", "value": "48ac69a4baa0bbdc20f7d6051f44c8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373868, "uuid": "fe5d1549-4e66-4018-ba14-791d84189e5e", "comment": "Malware payload (RemcosRAT)", "value": "bab65bff384cc974f7b0dc36080ab51841745997f9e7da4888445ce618ac3482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373868, "uuid": "f42207bc-4772-4bac-a4e9-6cd83a6e90de", "comment": "Malware payload (RemcosRAT)", "value": "267431883dbc03b853646a4ef6373771d8b29591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373868, "uuid": "242cb1d0-9946-4035-a035-3ffdd9c85bba", "comment": "Malware payload (RemcosRAT)", "value": "b028ac58e02fe024159765603210af6d5133d1c32327f6b008dd8aa32c7143ef424b8943f76f95f871b15f6756771b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373868, "uuid": "5f8e215e-7e19-4aa7-b0ce-20ffc8b6da42", "value": "T1764523906B9A4B11E87B27F91966D17043BA7CEA6B30E6060FD22DEF3723774441439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373868, "uuid": "38d28214-5477-44eb-8e92-085aad46f34a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373868, "uuid": "f6aa7f08-79af-4aba-80e2-18d03c9dce6a", "value": "24576:aolWG4UVE0nL9hPfm99V7yshcFDKsti+936TX2nAI/YhP/6HEpZlvPM:ry+EGLbm998shc3i+93Os+n6HeZlvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373868, "uuid": "f1bf0a30-6d1b-4ac4-83d0-daf74b3a286d", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373868, "uuid": "731c7546-ce8f-4a54-aa51-cfeb69ba1560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373868, "uuid": "18fe38c1-e61d-4cc2-8778-fc8c75b3d5ad", "value": "bab65bff384cc974f7b0dc36080ab51841745997f9e7da4888445ce618ac3482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5197b90b-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1786355600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355600, "uuid": "ccbef4c1-f557-4925-9490-4f4705346257", "comment": "Malware payload (OverlordRAT)", "value": "e133b5904ecefb5b6c167539d02a918d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355600, "uuid": "e07a8208-ad19-4fd5-9eee-c925b6ea3010", "comment": "Malware payload (OverlordRAT)", "value": "bb024a4c3e301b740e986aecf768d0d7947a75b33dccde6e52baf15c0b0a59fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355600, "uuid": "2c4f6dea-8677-4d1e-b41a-008db5ed12fe", "comment": "Malware payload (OverlordRAT)", "value": "3a9806711354521dbc851fe14d15b12e96c96e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355600, "uuid": "3c9355d7-b020-42f2-987d-a2f98c79671b", "comment": "Malware payload (OverlordRAT)", "value": "5b09fb0b4469b11df174ee6322cf9404441f27aa589c40a13f5941c6928e210ca76e68ed1ae326b2d3bd1caddb411b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355600, "uuid": "bde4fd87-57d8-4df9-be6f-6b4b88c4a768", "value": "T18AC63967FDA549E4C4AEC5348576E223BB717C480B3127D72B60B6242F76BE0ADB9304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355600, "uuid": "61b7e173-e556-4aa1-ae4d-49ce623093eb", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355600, "uuid": "ac6a10f6-53f7-4123-89a4-19f94efdc788", "value": "98304:1SBiGZJxraxdn7FT6JWj/QUkafd49yDLeEU1tOApEzyo:1hir6Z17QSd49yDL9JNzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355600, "uuid": "16b726ac-d7ff-448b-b686-7eaa2e74d296", "value": 12508160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355600, "uuid": "f842f90f-0bff-4774-b71d-1f646be93b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355600, "uuid": "eaa4e7bb-df0b-4470-88bb-7b66a7b361cf", "value": "e133b5904ecefb5b6c167539d02a918d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78005c6-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373917, "uuid": "ecc760c0-c797-42cb-ba54-47851254f5c1", "comment": "Malware payload (GuLoader)", "value": "9a774170ca41a6edff9629ca7bb2a96f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373917, "uuid": "fb62ee9c-817b-4c3c-aa71-f66d2dd32665", "comment": "Malware payload (GuLoader)", "value": "bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373917, "uuid": "054a53f5-975f-4ae1-a3ca-de73a5eb6342", "comment": "Malware payload (GuLoader)", "value": "2795a858dcb93cbf269554f448710ac6977ecf89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373917, "uuid": "42e4090e-6984-4f99-9a21-efc68216bec5", "comment": "Malware payload (GuLoader)", "value": "c4c6414f9849e8ee4dbb55fbf2f4e8f11d85dfb3583ee670da55082a8eafb58ac0fdad9331a6f1aeffec954e74dec0a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373917, "uuid": "20da3ba4-54ce-43ee-ab26-60e8f9b83f7e", "value": "T1B954E12472B6E047E5523A31CFA5E5F86859AEA0FD29E44733123F4FB8B5F81CD45092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373917, "uuid": "2778c714-af3c-4f4b-a603-e5d64a307c1e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373917, "uuid": "f8ebe1f2-e7b9-4e00-b480-5579022b4869", "value": "6144:Cbfopdha+pV8OJt1FuyKdnnKSqrQeG4hphjlRFFYMhmHW:CbIc+p+O71FuyKdKSqrNjR3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373917, "uuid": "f331a3b0-a743-4b70-bd44-e327de67e304", "value": 288056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373917, "uuid": "1dd426bf-7b7e-4d20-87b2-75887ff2a6b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373917, "uuid": "9f09a56a-01c8-4d34-90fa-b7b2b3c3daa0", "value": "bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68844c69-9495-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786350484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350484, "uuid": "1cad0bfa-5dd5-43b4-8ebc-30822b4f6eab", "comment": "Malware payload (Formbook)", "value": "a02aa86b025c34615a99437e118128fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350484, "uuid": "e2612a71-9b53-41f5-8fc2-ea7b3be9cdfa", "comment": "Malware payload (Formbook)", "value": "bbb3837bc8706b87668877a86fcda6a69ace99739e19caa744bef624570a7c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350484, "uuid": "30e9e082-9777-4347-b378-7965e18e9fb9", "comment": "Malware payload (Formbook)", "value": "9b490baf8909538616aded33ffa0502f8a6fa085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350484, "uuid": "43bb4fda-f9cf-43db-ab3b-c306882d8d1f", "comment": "Malware payload (Formbook)", "value": "f48b6c1fe3766a403e31cc8812c1524699339ef4274e345e635ca331dd17ba149e179bd3c538f6a0430c8ba38b2163c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350484, "uuid": "7f8bb9a5-c32f-44ae-b1ff-4f3a48aa810b", "value": "T14D252269A616D912EDA987760576F37243F0EECFB011F323CBEDDDAB7A1044818282D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350484, "uuid": "296e62b3-409e-4e61-93eb-50ce1eabd3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350484, "uuid": "7dbda952-1e75-4829-b741-a237a5b4d8cb", "value": "12288:8XMkckgQQ6zkHbsmiDPqaMypt9PJ26LRuCe4LTZPMMLrbAWjIX5gUGQX1cyTYojT:+4sm4PRptO7R4tMO5jE5g1VfeJzeIi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350484, "uuid": "2a7f5c08-8bf3-4aa2-8ac8-2dbd5d0af2da", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350484, "uuid": "b0029318-8941-4941-b16d-d37ecf1418f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350484, "uuid": "2b3dba02-a3ca-4398-80e1-8a4b06651153", "value": "proformainvoice396397740000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c43cb61-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404634, "uuid": "cd966e8e-1a72-4345-9999-9733c9c8fc4b", "comment": "Malware payload (Mirai)", "value": "6978451b1c8f92c754f4c3e6ff951604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404634, "uuid": "361ef720-2f36-4f39-9bdf-88e05e851a41", "comment": "Malware payload (Mirai)", "value": "bbbe8f578cb150ea93dc8dae245a626f9adcdabef7f10d766f8c4d69ed88c619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404634, "uuid": "760669e8-1dc5-412a-8e91-08bf7a908d8f", "comment": "Malware payload (Mirai)", "value": "3cb71e099c371bb2ad2122194fdf18d58d375f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404634, "uuid": "8617b6cf-9659-4d95-9499-585771b3782d", "comment": "Malware payload (Mirai)", "value": "eb17eaf2acc6a40da2cb86c359e40b60b4073accdfd486bcc3eb2f147a5a0232485eb2cbc3254995d944dd579e143abe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404634, "uuid": "4160d217-85aa-49c8-9bde-7601ff5740f6", "value": "T1B0137EE89A0FAEA1C7D2C77DAF6E4FA532163C7410E6C3756500720D9DB89968CF6423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404634, "uuid": "5a63ae9f-ab24-4d72-ab03-9479f41e8b2b", "value": "768:j7K6cyHOlsVNRTP8Rwb7YC9SQ77G57lp0cDEqeGi:j26cyHOlsXRT8S/9vSZQms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404634, "uuid": "855d16b8-e27b-497a-abec-e80a49fa2be3", "value": 42624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404634, "uuid": "8d2dddf0-f284-47d6-a29a-f857c1f15402", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404634, "uuid": "4fb400ae-e893-488b-9413-c8ae750b5a79", "value": "mini.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02679ed3-94dc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786380807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380807, "uuid": "45ae2c4f-a451-4f2d-9360-af3adb2fd1b1", "comment": "Malware payload (Mirai)", "value": "f6579af098857b3040340825ca77df96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380807, "uuid": "3f8cb5b4-6083-4ad1-87fa-cbfd87683b68", "comment": "Malware payload (Mirai)", "value": "bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380807, "uuid": "c9544c7a-bd84-42ba-8934-485c885cca82", "comment": "Malware payload (Mirai)", "value": "89b18ee0d71f71e8bcaca2cda2fa76dc27476681", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380807, "uuid": "94b34f93-6611-4757-85c2-a0e791f7723f", "comment": "Malware payload (Mirai)", "value": "350cf0afdca0dacbcaf6d45e1980a0c4f0424d90722e0b5e09bfd62aa338da3502c7fc4c44920816c998d110c5d5871d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380807, "uuid": "cd30fffa-7994-4515-bf9d-fdfed4bd30c6", "value": "T1DD315D9E04111E315102EA5E72A6221CA24DA2E72C5FCBD4DE4D0FBA56C83CCF265B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380807, "uuid": "c31de1c8-89c5-4e66-86ed-1e6e969a5943", "value": "24:5nSbCsBcCBs6247sXOTmCnwXPOv9RuDMRv:kxcWY4COCCwXPBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786380807, "uuid": "45a3bcf5-cc06-4c05-92c5-61b32b44f018", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786380807, "uuid": "b796ef8b-5bc6-4d7d-966d-0de0e5837ad4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380807, "uuid": "30ffc7d2-cc29-4051-974e-ed5b5842a4a4", "value": "bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8814ce3d-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349678, "uuid": "bffeaf41-d6ff-41e3-93af-5ea1a5e4bea3", "comment": "Malware payload", "value": "732522c4f07cac6a5eab26cf7df78306", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349678, "uuid": "49297225-7938-49bc-a1c3-96f0234fc60c", "comment": "Malware payload", "value": "bbf4d66047d9cf25308c65a390ebd8e9f883823870f219a5edfe488d4158f64f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349678, "uuid": "560a2a20-8494-4679-bec0-94ba9bdae9bb", "comment": "Malware payload", "value": "d08583fad61900e8476bcb63b94a3ae04a614d73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349678, "uuid": "3073418e-1d28-4f95-ad43-2814bd20303e", "comment": "Malware payload", "value": "0ff5f6ab7ba0b15f845cbe32eb6312726e48c1732f9f6911f55c1346fb78d4c591120fbb242839621375e9d7d4a187db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349678, "uuid": "8e541292-5b6c-408a-9092-991389f30e2a", "value": "T18103E943632D0A47C4672EF03A776BE09B9EBD6206E49140531ABFC442359F46296FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349678, "uuid": "798fe2ab-3901-4c9d-91c0-efc019b99656", "value": "384:S9Pogt7AOExlmyRhYoGTgARz3Qa9BlGtLE1axVsJTrbNhVXJrK3kDvI1/qdIj7sD:S9Pog1KxbDGo9xEHJrQ0DwkIXsd5HoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349678, "uuid": "0b3b7b6a-8d85-428a-9dbc-55835df5ff31", "value": 40236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349678, "uuid": "06b46bce-1468-47dd-8959-3674de2340a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349678, "uuid": "cac4d379-9956-46f8-a2d6-023a5ccfcbc7", "value": "main.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca321993-94b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786366110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366110, "uuid": "87ec5c3c-add9-4ca9-8a80-8b8da714c423", "comment": "Malware payload (PureLogsStealer)", "value": "e0ede72356471d6358a9e85241062210", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366110, "uuid": "8382fa9e-8e4c-4e3e-bc4e-d8f096969c8f", "comment": "Malware payload (PureLogsStealer)", "value": "bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366110, "uuid": "db536bd3-cadd-4da4-a389-0d5759c4e1d5", "comment": "Malware payload (PureLogsStealer)", "value": "482cd8cd4d031510877d0b78230649cac0043e6d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366110, "uuid": "c30bfbeb-1f92-40d3-8e2e-4f5ae2ec52c0", "comment": "Malware payload (PureLogsStealer)", "value": "dde406aa5745ba24e7e553ee8fa8e0199ad57b8ba146d2ab628511120f72ce8e2910b46a7d5c9ddd28340dbf036521e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366110, "uuid": "98714ff6-bc0e-4a87-adb6-20763518d550", "value": "T112250EDB9F75D68906287D6EC83CBE9D299BCD9000D0AA5BFDB88147F70E64901C4B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366110, "uuid": "4f664ab7-1af5-4ca2-9add-903513d81083", "value": "12288:Jkg55il92UK812V0Rx8goUW1imeeuTj5FRGB9Sux+/t5TKp75iLk73INHDCRMSl2:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366110, "uuid": "e1651a1f-d246-41b6-82d9-3865e1ea6e2b", "value": 1037817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366110, "uuid": "0d8a97fd-1f5d-4b4f-a81a-2590d0db793c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366110, "uuid": "b77d501b-9beb-4bf6-aa63-cab366e9c2d1", "value": "Purchase Order July -CEDF9837E748834938393003872143_docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c068f3-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373384, "uuid": "1e1409e5-7d84-4224-a533-5f021114abaa", "comment": "Malware payload (DarkCloud)", "value": "b99c85bf4a85f2a1b33798f48dbb0d61", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373384, "uuid": "658e8442-4cfc-43f6-80f3-f8ac22031357", "comment": "Malware payload (DarkCloud)", "value": "bc450a343cdc33ef6627f97bde60a4fbbe29c829191888b56dbc874acd49a1a6", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373384, "uuid": "9fa98c40-4011-43e4-891a-d424b2b755f2", "comment": "Malware payload (DarkCloud)", "value": "395becd5a21a1b786f33fef6f318b0b2141cf5ef", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373384, "uuid": "28c596f7-32f7-4153-afd1-adcec9c35f88", "comment": "Malware payload (DarkCloud)", "value": "e2d8e506fb5b0c84a8f96141a5f4c2e361ad064757f38f793e6ec3a5a932ac3e2529f035e49ac658deb4e0d9ab7ec323", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373384, "uuid": "696f5f7f-0266-4df0-b7e2-da20ece419f0", "value": "T18565E084D6059951EC999B71A932CA3462373DEEA8F1D15D2EEE3EB73FBB3821014143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373384, "uuid": "65da138b-8bb8-4224-a28a-91810a7f576d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373384, "uuid": "4ec1a199-07a1-4cf0-a77d-62a9f285cc1d", "value": "24576:2h3g/D3JA8hdblQNlQkS2h2+588CADS+awaU+MNesp50l1q:2lidA8vlQNlflm8CADS+awa6Nesp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373384, "uuid": "0d080ec0-eacd-4b37-900b-348a4af5d725", "value": 1474048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373384, "uuid": "63ddc26c-872c-403c-b2a8-fba1db2641c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373384, "uuid": "51d49562-2502-451f-96e5-f6ee874d99b4", "value": "bc450a343cdc33ef6627f97bde60a4fbbe29c829191888b56dbc874acd49a1a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63e3b06-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1786372627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372627, "uuid": "f466112a-1cd2-4c3f-8afb-958041bcce15", "comment": "Malware payload (ScarfaceStealer)", "value": "b9d86a9c297812665535e1bf93386c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372627, "uuid": "500bed18-6677-46b4-9e4c-d90c723f3e24", "comment": "Malware payload (ScarfaceStealer)", "value": "bca067481253addbd11c6fdcea3830541d5ad6676491f452e67250046b043ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372627, "uuid": "f1cf1bac-cc8a-4e04-9e36-af8a76cc3ec1", "comment": "Malware payload (ScarfaceStealer)", "value": "a706059e254c16df2779c9c721f6515d08ac61d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372627, "uuid": "f52a17f0-d9ae-4241-87c6-d06aa00ec9ca", "comment": "Malware payload (ScarfaceStealer)", "value": "8be7848c4f8330ecace8d2ac87f646a62251ed8af4f5d2d2773a8fdc709c44db9a30a20c5c4dcb2a05df146034cb35d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372627, "uuid": "21317587-8fc2-459b-becd-8693cf50f509", "value": "T1BC187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372627, "uuid": "23098687-77b5-43fd-9ce6-b1998f304b89", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372627, "uuid": "c1c5d169-2001-4790-b996-2b0afe8bce86", "value": "786432:nAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXWW:nAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372627, "uuid": "c22ef937-50b8-4418-a0ce-4d8c6c780ee1", "value": 90255360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372627, "uuid": "122aeb3f-75c1-467f-b0d2-ff2265986fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372627, "uuid": "38502ad2-bfa7-42fb-abf3-f8a7da07ac69", "value": "bca067481253addbd11c6fdcea3830541d5ad6676491f452e67250046b043ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25e4994-94b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786366043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366043, "uuid": "e34425d9-c1d8-4155-8ed2-27bb65717c61", "comment": "Malware payload (Formbook)", "value": "fef1fecf807b8f989b1c8ebf7402b8ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366043, "uuid": "93c136e3-87dd-409b-bebb-0e5365f126c4", "comment": "Malware payload (Formbook)", "value": "bcbc88bd07b46a7abb44d17664dd68f9369382348422936ebc082c7f19c4703d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366043, "uuid": "731be3f6-e68e-400b-9693-2c0530b71786", "comment": "Malware payload (Formbook)", "value": "02935f0694b3fee15f38e74ecf94eb59abe3ae99", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366043, "uuid": "ecb56314-b47b-41f2-bcd9-462996222add", "comment": "Malware payload (Formbook)", "value": "a189f8b4151b873458b3a6bc87301ccd22450930dc5bef249a5ec5dfdfe7150a59147b39ef1239cdf1ebc5381659eb27", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366043, "uuid": "3ac3acda-015f-4212-97c7-3d85df61dd10", "value": "T1C2E5F8411785AD32B3316B9C523AEDF0D90A965315C6CF2630ADF2187B6CD0BA758AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366043, "uuid": "acebfee4-504e-4666-a58e-b444cf127095", "value": "98304:M6Qfik0YHefQ6OSCQ83qn0t0agmd1CvOFAvaJZLgiZzqQQaz2md1shCsURT5GEHe:MxfJL56OSF8aDaC3aJtgiPdTd1shCDl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366043, "uuid": "9758c9d7-4852-432c-80a2-604f0599fa18", "value": 3154340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366043, "uuid": "2bf8aa30-ce56-4298-b1ca-769caffe0d0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366043, "uuid": "96535949-f7c8-445e-aa7f-c7f6825bab9d", "value": "Co_Details_Order_Specifi_PDF_.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874a13fa-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786330350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330350, "uuid": "47d249aa-4d76-4c00-8df1-e4b2e1dc4fdf", "comment": "Malware payload (Mirai)", "value": "a585b7fbd728721efa2f3d4412327adb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330350, "uuid": "10cea6ef-e438-4a86-8b3c-d2c042715cc4", "comment": "Malware payload (Mirai)", "value": "bcdd02c9f23821b3552843c3c7326102007845c81ca93ba0e8325c7932ada16f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330350, "uuid": "7cd665b0-a55c-464e-b7ea-11e5c5fb49bb", "comment": "Malware payload (Mirai)", "value": "844030c86b195d0200f7430cdf85a60a653a25b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330350, "uuid": "324371e1-84b0-4140-91a2-3e52b7cddf1f", "comment": "Malware payload (Mirai)", "value": "956e54b20568e41981de09cbe0731dac7562398adf01b3b995b0572cecf00015440009843124d5b3d61b632bb515ad6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330350, "uuid": "d52bea61-c9f3-4df8-a1eb-5eb5bda590b8", "value": "T106E31A56E7408B13C0D62B76B6EF424533239B6493EB73059928BFF43F8669E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330350, "uuid": "d77363ed-31b2-45b3-b95e-ba67fe5f2cab", "value": "3072:oo1jhPNT+RTa3KxlTxRDMlnndv5iq0m1+256M/9pPnMs5mHLN:oo5hyTa3KxlVRYndvh3+28M/9pMsIH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330350, "uuid": "48d07a16-b91c-4317-a552-83b3c28d8254", "value": 149192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330350, "uuid": "a048a897-132f-4e18-86a9-8ea62a6b111d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330350, "uuid": "8d7c2b4f-d691-43a3-93be-2a69263e2322", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba1e46e-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786373011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373011, "uuid": "c42eef9b-2372-4b09-9467-ee418985e593", "comment": "Malware payload (a310Logger)", "value": "f372f5b131ba76a46d5d196ad47d511b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373011, "uuid": "27b5d79e-00b8-4ac8-889f-bd51cf80bea7", "comment": "Malware payload (a310Logger)", "value": "bcf1d2546c48e935134c18dc49ab5682ba584774d8c341312c17ee512d706db3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373011, "uuid": "e4d795c9-7a9c-4bd6-9913-55e2bb5b46d1", "comment": "Malware payload (a310Logger)", "value": "0fe58a7ed71cd7019f55ce689172553efc8fc51e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373011, "uuid": "7bba8b9b-3386-46a4-9d91-fe6bb937daa1", "comment": "Malware payload (a310Logger)", "value": "d907d907daa3a283626232bcef1389d96e8854c0671bc3d32f18ffd2b5313c264e77daa4ef467f53cfb58aa2e0ceca8c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373011, "uuid": "e84bacf2-c757-46c4-a7d0-4c68f8c8c70a", "value": "T1E5944B13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373011, "uuid": "e5d50985-05e3-467a-b946-a04f6dcf6bb9", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373011, "uuid": "072f61e7-d238-4cb8-b8d9-403bb1f69dad", "value": "6144:B38d1/w5KA81IJ8GpF6nuTmOOUiBUrjII1aApjOCgWFnuD+DrywCAQnG3O0:BMjYKkJj6GmZUiqrN1+CkIrywXv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373011, "uuid": "5bc552c7-2bdc-43d0-a99f-b43b0043c416", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373011, "uuid": "0dc03831-bfcd-41bb-a573-c78890393725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373011, "uuid": "fac67a28-0b3b-4d36-a555-39b9710f5769", "value": "bcf1d2546c48e935134c18dc49ab5682ba584774d8c341312c17ee512d706db3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d0a1f1-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786355612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355612, "uuid": "4ddd7820-8a0b-4cf6-8fb1-81a29501a95d", "comment": "Malware payload", "value": "0044eab578a6444d7b18bebd47379656", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355612, "uuid": "255013f3-a0a8-4dc1-9cd0-cb6e6f78b062", "comment": "Malware payload", "value": "bd0e2521b98b7ca21072214773eae8b2343e53fc154634de89fc42c8ca669e4e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355612, "uuid": "532bd015-5d76-4e7b-aaea-ebacdcaae360", "comment": "Malware payload", "value": "66f0b588a9e0330c399ba88a4a0ad7699c1b97a4", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355612, "uuid": "4b3f5a7b-c7aa-4b7b-8db6-6e55fac8234d", "comment": "Malware payload", "value": "eb7958d1595e4348ffb74cd3b60b9f4b646c221b540d3f0deba4e11df4717ed295cb87d7589e6154d150da1575d305bc", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355612, "uuid": "9ed484f9-19be-4e90-bc1e-28f2996c0356", "value": "T1D8151201FF40897AD68613720BA7B1CAE71DFD17EE628A0F2301772E6D77AE1C560916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355612, "uuid": "95851c34-f3a8-49e1-9bdb-3572811e72b4", "value": "24576:pbLSv9k74KYt1QRT/64rmg27iigFRAEH:pbL34KYtmB6i2reRAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355612, "uuid": "b852735a-974e-45de-a446-e87dea8c9c27", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355612, "uuid": "2bccf3e4-ea18-4eea-8ebf-3ff76756a63c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355612, "uuid": "ab453c62-a342-4638-bf55-8511a7848c93", "value": "RFQ AUG 10 2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd688ae-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370546, "uuid": "a2fbb8f0-3b66-4b56-83da-8d023c35c34a", "comment": "Malware payload (njrat)", "value": "03a62e3c5dcc92fce35616819514c5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370546, "uuid": "51d316df-e510-416a-aa80-5bf5e15f25ed", "comment": "Malware payload (njrat)", "value": "bd236ad379e3d6b35c449f1f69447266088c4646baeb142cec9c7aff0c1a3232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370546, "uuid": "d9ac6826-bf45-4b4e-9d06-222af28f1593", "comment": "Malware payload (njrat)", "value": "3e310135b4443a12742edfb7a7dddc921a0c58e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370546, "uuid": "2d5866af-cd82-40ae-a66e-383ab2d5ff99", "comment": "Malware payload (njrat)", "value": "0ec03b5f46e650cc682914c7b85bff2761effc30ee23242900c71f6d32f19a34054204733bace20a14e6bcc3517a204f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370546, "uuid": "79151398-b88a-484a-8892-07134620a08f", "value": "T1910512A85A1ED821D5D317384FA1F37663B48DCCFA11C713A9F8BDDB381AA0BB815152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370546, "uuid": "a050a7aa-502c-44f7-ac91-b6f9f353c90a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370546, "uuid": "9a0c852b-07bd-4410-9604-da7568ef835f", "value": "12288:x1NuoFdMOraeUanafWVAbdqgWf4cby7tDdqxTZjTqHhg+PHrHhOfHiBZq8Uy5wfk:x2waO1U10gxDMehHHUKBA8Pw/+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370546, "uuid": "68819e59-b39b-47d7-931b-328fab52bce7", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370546, "uuid": "0f0ab82a-d6ea-4d2c-9c9e-f8728e3aa5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370546, "uuid": "215e7a3f-6057-4c14-82df-560a9816df02", "value": "bd236ad379e3d6b35c449f1f69447266088c4646baeb142cec9c7aff0c1a3232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67bdbc7-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370372, "uuid": "03ead313-2632-475f-abb2-2b437fc07685", "comment": "Malware payload (Formbook)", "value": "b537550a966e04e3ea3f8b0c670ea02b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370372, "uuid": "5c7dff3c-59cc-44ac-b47e-94a8aea431d6", "comment": "Malware payload (Formbook)", "value": "bd4f1b34b8e91b5bb8304734bd6e246b038cf28becaf437b32f56c61525130aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370372, "uuid": "701cfaf1-f90d-4be9-a874-d44fde55db0e", "comment": "Malware payload (Formbook)", "value": "3c128a5909cfef2887d0fb30e7a64a5f92c7a047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370372, "uuid": "21b8467f-1720-4419-a904-e9718d86d726", "comment": "Malware payload (Formbook)", "value": "ecb93dbf7adaa7f3dba71d77249a44965783e91406dbb1fabffdcdedfe7074bfd5abf3c54a9908c7b9efd0291fa0c6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370372, "uuid": "cfb945fc-16d8-468e-ae39-29c4f8af85b9", "value": "T1DE3523A46A2CD422C8D24B300E20E73943796C99E531C7535FF8FCEBB96AB076C54B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370372, "uuid": "55465d96-972e-44ea-8c1d-b783bdc07dd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370372, "uuid": "1f933f6d-b597-466f-959c-8beb903a1436", "value": "24576:5KlCvg2Phs4RUgpaRvChP/MZBLF9qJYR8ETQpM0uhl25UWmrZ2WJH1:5KlCvg2Phs4Sgpao3MZb9qJYR8KQpMHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370372, "uuid": "44cae588-5e5e-492a-ab33-49ac7aa2ff26", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370372, "uuid": "156c7c16-a8dc-43f7-9b27-3c67171cf9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370372, "uuid": "3fd97652-12df-4253-9d07-9328be69810d", "value": "bd4f1b34b8e91b5bb8304734bd6e246b038cf28becaf437b32f56c61525130aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d8c361-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786371022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371022, "uuid": "cf0eda3c-a84c-4325-814b-5f405b2439aa", "comment": "Malware payload (GuLoader)", "value": "925656b61f4ac44db4c928877867bf8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371022, "uuid": "4915a2bb-552e-45b6-9457-8227c9587c8f", "comment": "Malware payload (GuLoader)", "value": "bd7d701420ff8566d513833578ab576535bae55a2a700e0d6eb2c054a73bc017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371022, "uuid": "eceffdba-0155-4369-a99b-de76bac14183", "comment": "Malware payload (GuLoader)", "value": "b12779e69ffec4614e443532818645d8a2f52942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371022, "uuid": "5c65e088-d009-4554-ad1d-1c1997fa6aea", "comment": "Malware payload (GuLoader)", "value": "705ea470eb15943e2043b2ce48550976b92c661984bdab44d89b94ee2c8a6e530d907406997d6822fe74c94483639278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371022, "uuid": "fcda717a-5006-431e-82cc-2cf80cef7ad8", "value": "T14984AE13F6948586D81012F04C3FDD6922636D7899A3560F3EADF73DAEB3292F01764A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371022, "uuid": "a2db72d8-f002-4ab9-9bbf-69264a980b77", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371022, "uuid": "b9f029b4-9120-4a78-8f5a-890a3c9a185a", "value": "6144:uTA8oPSCIjz63pQcNRCH+4peNZdg7+72Ynu+jtX:uTA6zMCcKHre12+qADX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371022, "uuid": "c04e6a3c-d60f-4201-9258-a040482489ba", "value": 402320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371022, "uuid": "e2d1329a-7284-4f5a-a1fc-0687d7eb39d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371022, "uuid": "befc2b35-0faa-4c8d-8720-6fbbfcd86346", "value": "bd7d701420ff8566d513833578ab576535bae55a2a700e0d6eb2c054a73bc017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba7c733-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340048, "uuid": "e5039ba9-be4b-4325-8d1d-28290adcd0b2", "comment": "Malware payload (Mirai)", "value": "5d47f5d0a21031abeb8a9e3c7423158f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340048, "uuid": "8a65b1b2-7f7d-44d8-a315-a4f446801db5", "comment": "Malware payload (Mirai)", "value": "bd89da299bc04921f6f29272e9726cfca0b36536fef6162eab6051fd483ad645", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340048, "uuid": "aae086b8-2e01-4173-b80c-c0c705266089", "comment": "Malware payload (Mirai)", "value": "b2d3c23442f01483fd94cefac772c7c4bb5b81c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340048, "uuid": "738aef12-3980-4731-aea8-bf3be5ff0b1a", "comment": "Malware payload (Mirai)", "value": "e7c64502871cb9035baad5ad76227683473af68403db28578c3cfcbd570d65ebf02db58442f68cdfd33157909f3b4b88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340048, "uuid": "5127ee56-aff8-4cc9-8d21-ace0ac52a40a", "value": "T1F374EA88B5F2E2CAD1D4EAB5E319784D3B630736B5D73145A50EEA3312EF14809BDE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340048, "uuid": "9c7ad830-0fe6-480a-a952-82980e6d5dec", "value": "6144:sQa9qC2qmERIm+Jn936fAU+odWS5OJomA9/a3e+5:sQa9qtbEY36YU9lOyP9/a35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340048, "uuid": "764fb7d8-ecf0-40c2-9cb7-a495e2e801af", "value": 338040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340048, "uuid": "c09f1517-f934-4b0e-aefe-152837930b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340048, "uuid": "15cecdd1-52a6-4174-a8b8-7b8a64542438", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d251bd50-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339925, "uuid": "b29ca1b5-3a32-4d29-b821-b4562ddad511", "comment": "Malware payload (Mirai)", "value": "e0bff240cae944ccc3cd94e88bc07e94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339925, "uuid": "f30f6d31-2561-44bd-a972-16842daa04ad", "comment": "Malware payload (Mirai)", "value": "bd9fd7e9029aed7cd3725c117ebe7c1535db09efb0671b281cf48cf827b2d806", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339925, "uuid": "bbe636c6-7d8d-4e07-8875-2b547e1aafda", "comment": "Malware payload (Mirai)", "value": "b9012c97a24e09fc1c1a207eb52b2259a9bf4c52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339925, "uuid": "9b2353c1-50d9-46ac-a4b5-23e1fb657210", "comment": "Malware payload (Mirai)", "value": "c51faab7bf58fd7e01ab9bb83fd281aec30d4db183aa9a0be535b9686ce8448b97e6d3432eaaf187ae33f6e898925f98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339925, "uuid": "a029f116-3a72-4acf-82b0-f8911987d085", "value": "T19F74FD88B5F2E2CAD1D4EAB5B319784D37630735B1D77146A51EEA3323EF14809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339925, "uuid": "b7f440e4-09dc-457e-b0b9-ea6346b31dbd", "value": "6144:Ha9za9Ua9CEqYdW2eCzmKDh6kTvEFrPugrG+4+AYjHlsx:Ha9za9Ua9CEqYdWn1+dzgs+AYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339925, "uuid": "8927f413-6cdb-48de-857a-8a6641027661", "value": 366960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339925, "uuid": "a2adea76-73f2-4a28-a1de-217739540cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339925, "uuid": "bfd6e366-3f61-49a0-93c5-97be16436d28", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d6fb09-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339927, "uuid": "26eefba8-1406-41f1-a7a9-012ec133081d", "comment": "Malware payload (Mirai)", "value": "bc01b3a786b774b0653a314b53ed2a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339927, "uuid": "d1081323-55a2-4b69-b50a-d47f45149c4b", "comment": "Malware payload (Mirai)", "value": "bdd42fe3bf1dbdd49961e021cef3d6c4d4694c77a0fdd1e1d58960f7181c5a12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339927, "uuid": "1a0c0571-097c-486b-b044-a3f7c7905f1d", "comment": "Malware payload (Mirai)", "value": "9accde936a8302c35008882a3a58d5662a9d8f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339927, "uuid": "76eb7e4c-468b-4c9f-bc26-5a72a1ee9732", "comment": "Malware payload (Mirai)", "value": "ca763037b1d4f7189427005159244c36d266c25ca30add35c3ad5a5d5cdc7de053f274e8eb0d4956ff03fbb7978e1f56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339927, "uuid": "2b9ea054-a308-40c0-9e3e-e5e3f6f7191a", "value": "T140843A4863F1E2DDE158D674531ABD17AE71513731A3328A339FBA7327B70804AEDA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339927, "uuid": "6fce7e9a-f52b-4931-bdd9-c0f771c8125b", "value": "6144:Vopa9Mm7pY6v91K1yHCwk1cKpw/cWvqA5yQO:Vopa9ME9SyH+19/mqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339927, "uuid": "73a29fe4-3f94-485b-861d-e1219ed74f7f", "value": 383016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339927, "uuid": "72364203-beeb-459e-91f5-56ced9bd2a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339927, "uuid": "77ac62c2-0637-41ff-bfe7-e1a618d8c49d", "value": "vlxx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ddf1d3-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356844, "uuid": "e769e852-b72e-4336-a168-067164e230ee", "comment": "Malware payload (Mirai)", "value": "bad104b0a907022dba93b064fb8f818b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356844, "uuid": "370f0aad-d806-4af0-b2a5-008d80d56500", "comment": "Malware payload (Mirai)", "value": "be9d54109b23bf1ca1abfca12c64e00ab5aac1e48617931f0bc93840e05b145d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356844, "uuid": "de61ff08-567b-47d3-8763-8b5f96687343", "comment": "Malware payload (Mirai)", "value": "e681c6d8eb5ec5d564226df361372ab9803c4a23", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356844, "uuid": "d8fd5431-ead4-45a1-bcc9-4ecbb96a6657", "comment": "Malware payload (Mirai)", "value": "245b83bab9eedd439a2146f319c6099293e195811db521a659fe6974ed2d9275691b06716e52b77e0de1de16be671f2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356844, "uuid": "f9a619b3-a35e-4148-87cb-cb9ce1546960", "value": "T10F146C16B98080FFC496D1781BFEF43AE931B0AE5278725B27D4AF262D4DE615B2C740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356844, "uuid": "812dc984-9dbd-4d6b-a012-9faf5f4e68ab", "value": "3072:G+wyfortJ8WzCKbh8TBBrJfUAGYAQCznl9Y6vyA1vWzJUUug3vQ7obj:DwCortJvzCRVmfXv+OxNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356844, "uuid": "cd86a2c8-9921-481f-9eb7-8f8c323693a3", "value": 207528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356844, "uuid": "a6ae8aa1-4bd0-4c0d-a577-13a9e131c09d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356844, "uuid": "8cf16af3-a7d6-4d93-bf66-f048c0d89e1e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668453bb-9475-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786336737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336737, "uuid": "23de1776-e446-4e2e-8657-4e5220babd3e", "comment": "Malware payload", "value": "e7f2a8ad3c2126500b0e704f55405d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336737, "uuid": "67c02e3e-2f14-4bce-9d7c-8bfec69ed203", "comment": "Malware payload", "value": "bed4b7952c79bf278a0daf0e730525fa2583d7f5cf968d877b5866d4490f4039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336737, "uuid": "3e51305e-e4e1-4f5e-8aad-80f66f996fc4", "comment": "Malware payload", "value": "0a7d4be3302bb06e514fbde1f880290a0918722e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336737, "uuid": "313d1321-334b-4460-a5f5-9f3c08bc378d", "comment": "Malware payload", "value": "bfe00e2c0687d4b4bc8d453168f499d1f32e2f03a15a40007bc103a4d6756babce9af5f88b6cb28eb840c2e464716bf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336737, "uuid": "9246c530-9de9-4b26-9a4a-79df025e107d", "value": "T137538E6AF0EA9CF6DC5095F5E8B691300B017CB123DA0C95F95DB2944B3F94ABE4CB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336737, "uuid": "9b618c8b-4e76-4cda-befa-9ad386993c37", "value": "768:KUVoZdaYQDBjHvWpTiFtbugcWxcOPACcg6UQFDncGDItRi2Or8m:7gde+pTib6gc7DCcvrwWP2q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786336737, "uuid": "204f57cd-efd8-4dcf-a5fb-a6c937febf46", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786336737, "uuid": "4d075f28-4c7b-4e9d-934c-3a0d935102c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336737, "uuid": "afa2364e-96ac-41a1-a0a6-4bd276b447ba", "value": "bed4b7952c79bf278a0daf0e730525fa2583d7f5cf968d877b5866d4490f4039.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f1e7f4-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373530, "uuid": "95777efa-8afb-4993-9057-21d601624ceb", "comment": "Malware payload (RemcosRAT)", "value": "0689d7f30f0bf15f1677685bc1b81763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373530, "uuid": "7d15ac92-e93c-4ba6-b009-2735ff488a9c", "comment": "Malware payload (RemcosRAT)", "value": "bf24bb51af4d6c922bcb3eb46a712fef9cf3ed76822ebde5669a62673bf1d300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373530, "uuid": "5301ff85-bf18-4527-8e4a-2b8831182a0c", "comment": "Malware payload (RemcosRAT)", "value": "83df1e5445c0fedb4cb356b5d6078b06ab7b3a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373530, "uuid": "da0790a4-d84d-4057-adb4-b2c58d62aaff", "comment": "Malware payload (RemcosRAT)", "value": "b583db277b3fa97331973e6edd1ad5151de7dfba5d89e44b47ee15e7fa3693fad7063bc5ff60b38c201426103a5c3797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373530, "uuid": "4efbd9a0-2ffc-4261-bc5a-1f0de6e503e3", "value": "T1A505F1641306DE46E0D68BF6B8B0E37432752DCFB9E2C3925FEA1FEB78193815554282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373530, "uuid": "1b20e06c-b8ee-4100-9ec7-ff8c140717a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373530, "uuid": "676c0ead-7269-42da-bbca-c5559e695448", "value": "12288:hIQEk+Yxxltnn0gXuSNZz67fZ9q/sx6x5qPcIp35F44Ez9zMgX/+sp6PqA5RkTJb:X8Yp50WW7f314fqUItpm+snoOToxMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373530, "uuid": "393be8a4-cc52-40e0-addb-b408dc7170d2", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373530, "uuid": "37d00b2f-1b06-4615-9cbc-9e5e8f086b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373530, "uuid": "df2aa67c-9677-4a0b-81c7-88c563c710e4", "value": "bf24bb51af4d6c922bcb3eb46a712fef9cf3ed76822ebde5669a62673bf1d300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d836194-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353821, "uuid": "88021e63-4a79-4f4e-954e-8b5c73dc7d83", "comment": "Malware payload (Mirai)", "value": "15ecd6e7003e0e0666b89f0d43dc069e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353821, "uuid": "ff82cc4c-4c8f-44ef-a5e1-c06171ce257d", "comment": "Malware payload (Mirai)", "value": "bf54f361748f9caf7a74d68251350fa70c079cb1093ffc7704b05d9a24f185a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353821, "uuid": "2ac220d1-3e17-4321-a7eb-bc02f41bab73", "comment": "Malware payload (Mirai)", "value": "846fa5fb07f8c5deeae22984c653430bd3296299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353821, "uuid": "0cf2b60b-6f74-4841-8836-d6f460f4badb", "comment": "Malware payload (Mirai)", "value": "19b89c5677c395708e1a8f87c07c1f83eeea826c732de6f493223682904503aaba262339355b19fee2e03fd76f60c353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353821, "uuid": "5b5e4011-6560-4fed-a956-a7d7d6efe2dd", "value": "T144140A01B8104B57C5C32BBABB9F439D3B375B1897DB3301AA25BEB42F8679C5E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353821, "uuid": "a7453067-1cfe-4cfe-a7e2-1b901a4e327c", "value": "3072:mKj8ddNvtw6nrMLE/sndSExGSsk2mWvkBGYRvZ2s4aG/2+LwD:+dVtw6rMw0n/xGSbWvkBGYRvZ2s4aG/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353821, "uuid": "1a239549-0317-4e81-bc1e-2db480156346", "value": 192474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353821, "uuid": "5415ec1b-cc9a-44fb-83d6-167c6c880934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353821, "uuid": "8bb48047-e0f7-4770-8a20-d7bd853e71f0", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efbbd14-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369339, "uuid": "b4e9c706-3791-4780-a432-022e8742a84d", "comment": "Malware payload (Formbook)", "value": "163e8c0137b6ee39f27f05c6214810c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369339, "uuid": "bc1a50ec-971f-4573-8621-c20fc9b013f0", "comment": "Malware payload (Formbook)", "value": "bf5d6a58697756be8cc33c9deb70a7f21597842844fcbf44aa3c518c68ab6864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369339, "uuid": "84084bb0-7e91-4b6c-be6d-bbfd69a73218", "comment": "Malware payload (Formbook)", "value": "8ea02cc0f017ef28905635dcf887a79a8d5265c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369339, "uuid": "3390f3a9-1f98-49fa-ac09-10a08e015e95", "comment": "Malware payload (Formbook)", "value": "e16bd87d9e865554b257eda15ff4a3d0e8c11ea7f396b8f949b9b820980f591d4bfc88dec67640674170133ce19b5589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369339, "uuid": "6721ab5c-9dff-4aca-ab3b-55b44049b484", "value": "T11345F14457A8CE07C46A13B4A4B8D2B80B755F1AF622E3175ED4BEEF79773228C14287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369339, "uuid": "cf3765a3-3555-48b4-b134-e68071cf2c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369339, "uuid": "fbbb5e7b-9c5a-423d-b5e1-373faba654e1", "value": "24576:gAGvV0Ljlcyzoj8mmUCFNDCBkovWgDImHfctnwwUUOGK4Auu1oIoR:gAGN0LjTz5UCFdik4WgDIBnwwUUO50u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369339, "uuid": "f2b36abe-5180-4d69-9aa0-e1d0f00bc38c", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369339, "uuid": "a30cc51f-8372-4258-931e-0463687b936b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369339, "uuid": "42d97e62-ccf5-4b0e-958d-f33aa2f4908f", "value": "bf5d6a58697756be8cc33c9deb70a7f21597842844fcbf44aa3c518c68ab6864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185b9688-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373543, "uuid": "40100cc1-4fae-431d-877a-66fe2871ef29", "comment": "Malware payload", "value": "d9af62093c5381db6d09e165ed2c9129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373543, "uuid": "436eeefc-410d-48f2-bbcb-10e944694757", "comment": "Malware payload", "value": "bf7fbbfcce88950f1b509cdd2e733d39032f4ee747069c3fded34cecc664fdc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373543, "uuid": "4f930413-07fd-4f74-9dc3-9c05b8fc0ba4", "comment": "Malware payload", "value": "e6f57bb542ff4c35dd65703e13aafd71ba180c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373543, "uuid": "c6aafa9e-39bf-4c2d-a0fc-7d173f88f61a", "comment": "Malware payload", "value": "4b09dc0436b23532940bf429a6b1457fdf4291352d766ffcb4e328251ed8cdd5c1591105a1d049518ba74f54f9723b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373543, "uuid": "efee59f4-5ef3-4ed3-be3d-96999198db3a", "value": "T14BC6E13F624BB93EE06A6735B972D160443B7E65A4024C5396E4F84CEF258B02D3F786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373543, "uuid": "c32d2c48-e338-409c-bcb8-8a5818b9f5ee", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373543, "uuid": "41304b7e-afde-4aee-aaa8-b2238055a5fa", "value": "98304:p5OD9KhLdyz/m3hUWnIaI33djOLsEx/hBKlksl0LIGkB:jU9SLdyzm3yeIaM1O/5hBKTeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373543, "uuid": "9603fbc9-8c4d-4871-a193-e4526f61abf7", "value": 12245137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373543, "uuid": "23c8fad5-c960-444b-bdb7-716de68d15e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373543, "uuid": "5243ce40-9b9e-4c9c-b2e5-9c784741dbb8", "value": "bf7fbbfcce88950f1b509cdd2e733d39032f4ee747069c3fded34cecc664fdc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73698886-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "419a9d6b-a226-407e-ba64-bf1721bf63a1", "comment": "Malware payload (Mirai)", "value": "cf1c8c81a70085ec40fb770155018d40", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "c2e8bd98-cf4b-40d6-9733-024d40076c77", "comment": "Malware payload (Mirai)", "value": "bf88bbcf988afce3fdb04ea8644ad25ca96818e3d43e5ae54d2d1315af64fe83", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "609eea53-a264-4bba-a212-7914ad1fda7b", "comment": "Malware payload (Mirai)", "value": "eadfb2b2d187e5cf095d68433f42533ece8e7b28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "771dc96c-268b-444a-86af-76d73a1e07a9", "comment": "Malware payload (Mirai)", "value": "19bc693801d0278e306142221d27c47ac98d5552fd5e121e58e1d087299c364ab78c3f5a1df2f03dc8a4e52dc5aec2c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "c9ceb48c-b0cc-42e8-86a2-2f09481270f7", "value": "T134443A86EA818F13C0D617B9BAAF424533339764D3EB73069A14AFB43B8775E4F26501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "c8c19fb1-4405-49a4-99fa-dbc1869e622a", "value": "6144:RYgH62jbA6dnKL1FIohaeKAo+uF7bg8mSuuWqRy/zn3M/R1DNGmn02v0PbUyM:2gH62PAh/Iohae0+uF7bUSuURKn8/lGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356945, "uuid": "e0361134-5c86-44d1-b689-e69f0ebc9a8a", "value": 270523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356945, "uuid": "3a9bdf44-bb57-4ef1-9d80-e237db79cd03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "2faa6c79-69e8-4c86-936a-ee31787c149d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932cbdfe-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786371601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371601, "uuid": "ef75c5e4-8640-4834-ba6f-1b745917fc3d", "comment": "Malware payload (XWorm)", "value": "6a67fdc18f117718c1afc6058316b7af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371601, "uuid": "4c77d903-79e8-4627-b73e-6b8f4d443136", "comment": "Malware payload (XWorm)", "value": "bf8d6c2f8125dc85a5a830c5e940951441c92823db6793794008301ba6f3f5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371601, "uuid": "03f893dd-3a38-4664-92d5-1f4ceed73723", "comment": "Malware payload (XWorm)", "value": "a6a5363349b117c4716db6c40c5a6bfec6a839a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371601, "uuid": "bd8742e2-b527-4554-994b-32b2e120131d", "comment": "Malware payload (XWorm)", "value": "c7801ada8fcae5ae6a24b101d4babca5cfb99968c884a9cdd1925ab96d046ea5114374b6bfb74159c529052fabc7a6dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371601, "uuid": "b351a6d4-2853-497c-846e-ee0e14961435", "value": "T174F4124C6645D917CA6013B11E71F2B827B96EDAE400D3267FEDBEFBBA31A145C04293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371601, "uuid": "71351e11-dfe0-49ec-94df-5076fd9c1fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371601, "uuid": "81f20bfe-73e8-413d-ae31-02738e8d9243", "value": "12288:flJdbW6dgc+38p0Wlyy3x3dqLc4KCPU2gWy2IjbhB0yDerVCHuIXvSwe:fBdt+eD34Lc4KCPgWevPdSrVCO0vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371601, "uuid": "ca657ef4-b66e-4799-800f-2564958b183a", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371601, "uuid": "17dc544a-0dd3-4009-b975-59fb17d8bdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371601, "uuid": "7e46b82a-cacf-4bb9-a635-8af3c36d3e3f", "value": "bf8d6c2f8125dc85a5a830c5e940951441c92823db6793794008301ba6f3f5d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52af77fc-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369346, "uuid": "9c038c3e-b6e1-49c2-9ff7-63f5deffee70", "comment": "Malware payload (Vidar)", "value": "2fc5158072badbf2532e8a86194ee01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369346, "uuid": "f0ece673-1976-452f-a4f4-14f8d58b77fd", "comment": "Malware payload (Vidar)", "value": "bfb6f288dbfcb424e9eb86d81fc7b19cf544c2ee40ed17faec0082891c46a45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369346, "uuid": "79435856-de5a-419f-97ab-e74fd3c01a61", "comment": "Malware payload (Vidar)", "value": "a2c3f506e11ef75168a1ef2dcdeb2f74a737fdb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369346, "uuid": "da698da9-746d-4d39-88c2-1f68eebbdb68", "comment": "Malware payload (Vidar)", "value": "3f54dbf8879c49755e0b9a82c902ee0e4d1afdc51f9e48591a6f132a85bf3402e2a3a27e14ec7df1670438b841f238d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369346, "uuid": "ff390e4a-5ee7-42a3-a4ff-b3bfaaaba411", "value": "T1D0926049E11B9AE4C4E6C333B766115355FCBD2021356A3B9BECAB3A4D52330E7582EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369346, "uuid": "d6f24737-e0fc-4c36-9531-2a5df919c1a4", "value": "cf623daeb316fdd052c715e1828e1b00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369346, "uuid": "e4726faf-fd7c-4589-9a21-60edb2408c92", "value": "384:OETsOSuaD0i57Tuv/WHXC5hpPuENYL/FJPxmXVlTWZUnpMol4jl:7Aea93XC/IJZmXVlSQpMM4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369346, "uuid": "2fac44b9-b00f-49d2-bd4a-db51a5c43562", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369346, "uuid": "9c63a9d6-dfc6-4bd0-9ebf-40889274e8bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369346, "uuid": "f95439c3-f22d-4e4a-b64a-3da5b264fcfd", "value": "bfb6f288dbfcb424e9eb86d81fc7b19cf544c2ee40ed17faec0082891c46a45a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67850f4-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373835, "uuid": "f2c9f1b4-86f4-42f7-91d1-e17b1a9249ea", "comment": "Malware payload (Formbook)", "value": "880df3e8d72b540eaa07c303c2d3e7fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373835, "uuid": "298d0cd1-05f2-4dfc-b034-3a84ca073361", "comment": "Malware payload (Formbook)", "value": "c000b2fffd6d6f552f2ec347dcd6c4e12409cf7207c27407225164e010d8c21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373835, "uuid": "d960d8e0-e4ba-48ca-abb0-350e4c24d307", "comment": "Malware payload (Formbook)", "value": "7275a7cb26b08ae103fecbe3074ba53cd25a40af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373835, "uuid": "70e6e595-b0a0-460a-9f94-a2728ee0f322", "comment": "Malware payload (Formbook)", "value": "2319c1c659ee25a5553e45778a8cb84cd55e6d0f90ecbacfff17294e3dce5508ec1e562c72df759c50f686e6bd12fb6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373835, "uuid": "0cc8988b-97da-4774-ad6f-5e98e87611c8", "value": "T11B35129536588A13E8FB1BF82979D9704776BE9EA931C5021EEA3DEF3C32B044500763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373835, "uuid": "aa36ac20-a188-429f-a836-e6a955af61e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373835, "uuid": "5377298a-ccfb-4910-abd3-14b8895de5c4", "value": "24576:1s1Z5klDOjW2KAqB1ijphQOkIRDz2KkbxSBX1vm2kYHeZ:K1o0jW9B1ijpad+z2KxXc2tHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373835, "uuid": "07c59833-5ffe-4679-8c6a-d4605793546c", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373835, "uuid": "d1b834e7-77e9-4e1c-8e83-bcf68e0eafb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373835, "uuid": "e0596e40-3638-4ace-a160-533e0beb1431", "value": "c000b2fffd6d6f552f2ec347dcd6c4e12409cf7207c27407225164e010d8c21e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2f5031-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371214, "uuid": "14995e76-95de-4064-af1c-72bb68552629", "comment": "Malware payload (Vidar)", "value": "01ecd6a148432af5ff43a78b98de1c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371214, "uuid": "26b4729e-f918-4eb4-be5f-93a5b986e775", "comment": "Malware payload (Vidar)", "value": "c00836749fb2d95d9b7aa27b727b941ca912a6f9e9194ab03f847fab470441d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371214, "uuid": "5702e0d2-510f-4201-84cc-54c3b8221d62", "comment": "Malware payload (Vidar)", "value": "079d3817a92dfcb559cf5952a1959c09dd6778f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371214, "uuid": "83e74883-10c2-45da-97a1-00eb8afde54d", "comment": "Malware payload (Vidar)", "value": "f1afacab389eb29253d5fae907451b628bf87067f5b963ec14d110ee759e7a5228141958f7f2ccb400f0bbaa79265f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371214, "uuid": "126c7188-50d0-41b5-9d51-ccf65e8436a1", "value": "T10D52E786319360FEC16A83BCCF4A56BBEB2234AE432E5FFF45DC81656AD160159B8701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371214, "uuid": "648e059c-452c-473e-8768-d54ae3123c1f", "value": "de4da189dce4a2df3103d8e87a228861", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371214, "uuid": "faa7a45b-c3ce-44c8-a39e-a5331bf233ea", "value": "192:Obuv7V3sc4rR7ZX91B+IGGftvroFbyF8/i/CNDTb+Vbk6YiK405oqYf3V9:OKvxLILBThkFR1+V8iM2l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371214, "uuid": "b1af2a03-18d2-4172-ac51-02901479a9c0", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371214, "uuid": "e25cd2ce-8978-4737-b256-bb713a8389db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371214, "uuid": "aac12c6b-5801-4aee-8ec5-0e9f57869069", "value": "c00836749fb2d95d9b7aa27b727b941ca912a6f9e9194ab03f847fab470441d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87de6f9c-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1786369435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369435, "uuid": "f606fd51-e5da-4034-93b2-90999910521e", "comment": "Malware payload (SiriusRAT)", "value": "0905be2d0ffee2f6dc78bc9bc250f336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369435, "uuid": "758f93f7-0db9-4afd-a261-32e1e65cad20", "comment": "Malware payload (SiriusRAT)", "value": "c03c96bbecf6dde593d0379165c3594a758d5d8a398cd5e16b53b22a07595af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369435, "uuid": "a802a459-0f18-4199-b8bc-acac9d10881b", "comment": "Malware payload (SiriusRAT)", "value": "2a1e2010d6b84c6834cb9a0777d33abe6d31452f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369435, "uuid": "1aa28c3a-b12c-4148-bf4a-7ebd60e608bc", "comment": "Malware payload (SiriusRAT)", "value": "7ad201a240ba4a31650587da9aad23d1c4b76f3428d727ab33e1fae5340681252070d391113fb4f6e9baf05c40e16087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369435, "uuid": "cffb9b8f-2925-4b8b-8658-51c42132f8db", "value": "T19DE523449798DE4AC66E07B869A4D1340F742E19BA62E3170FE4FDFB3C747268C59283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369435, "uuid": "16e69606-a298-4907-8b80-918e28ab4036", "value": "49152:YAYN0LJm8yhkgAYWj9yzdmF6v8OHtfSHqGsL5pg2MfB/aDjAw5OK+s:U0LJvyqrJyzwQNaHISiYCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369435, "uuid": "ddb914ce-1e0f-4d05-9248-4665648ec3fa", "value": 3054080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369435, "uuid": "9bacf68b-15fe-4e5a-8b71-61bf4f72a840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369435, "uuid": "3ef62199-8b55-4de4-b849-52f9861806fd", "value": "c03c96bbecf6dde593d0379165c3594a758d5d8a398cd5e16b53b22a07595af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853f9b1d-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373726, "uuid": "2b1c42c6-d0c8-4044-b3e5-f8b8c7d76a23", "comment": "Malware payload (AsyncRAT)", "value": "ea1f02d6979caf59624e2b9094f82476", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373726, "uuid": "04ac77ee-a8b7-40a3-bb46-cdcaf6c1a47e", "comment": "Malware payload (AsyncRAT)", "value": "c0648293a1c2cbfcdcf80e0b094a7daee067aa1a2632b3f5a639a465809a7ce5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373726, "uuid": "a6a1f544-ec4c-4e9e-9c16-b68a4c9b4073", "comment": "Malware payload (AsyncRAT)", "value": "e03617cffa5751d433eb17aaffc71e0e5e41f109", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373726, "uuid": "7ee68416-9278-46d1-a0c3-27b064e06a44", "comment": "Malware payload (AsyncRAT)", "value": "84c9c34e5e65c33a39043e3155abd7aade451c35338c32d8b2a76b6831a8a09b9b8d1d4a8cc10f13f4130942c2006a3e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373726, "uuid": "3f326fd4-6829-4720-8ed8-331d5f607605", "value": "T10905120532459723E5BA1BF90939EA7053B8BE9DB631D22A9FCA3CEF3536B005911713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373726, "uuid": "a94c7db5-c6c2-4e36-966f-d15485c05353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373726, "uuid": "1901bbd8-75d1-40c2-a239-23659ca72434", "value": "24576:Kb/Uk8p3gfdpVkntfXGyyTYP+UCvrItrzfeZ:HUdvknV48P+U/Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373726, "uuid": "3183d939-443f-4320-94e5-74238cad90cd", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373726, "uuid": "2d1efaa6-e147-483c-b7ec-75236c9b8d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373726, "uuid": "bad7bd2d-401d-4ba4-83cd-ca6c260bc24d", "value": "c0648293a1c2cbfcdcf80e0b094a7daee067aa1a2632b3f5a639a465809a7ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1f06e0-9455-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786323107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786323107, "uuid": "b0f6e456-e557-4792-a516-40f3b4e8e57b", "comment": "Malware payload (Mirai)", "value": "6176ecd1410b3909ef4f3005a9b1ed5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786323107, "uuid": "3247c814-2969-4b16-8cb7-174ce82e83d1", "comment": "Malware payload (Mirai)", "value": "c0c587eff26893624f4fa504208ed33fe03589228406431549cfead5c44f17e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786323107, "uuid": "863d4d99-ffb4-4e6d-9483-d9e1cc33ab04", "comment": "Malware payload (Mirai)", "value": "93d3e322ee46891da3de9c07a58885bf764906d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786323107, "uuid": "a8da9434-8200-43a4-aba1-9f61245c95d9", "comment": "Malware payload (Mirai)", "value": "372eb6e05cd54f631bca93c27fedc4d130293bfcb4dac312c7110ab2a3fcbdb52a039cb9cc0af3a8524edd620fdbb8fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786323107, "uuid": "03e11e85-96ab-4e0b-bea9-76b8c2126fc8", "value": "T1D9A47D0339760D26E4C5A57551EB03A2FAF693CB20BC4B1AFD940CDABF167A070522F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786323107, "uuid": "6a99ca18-bfc7-4913-855f-06dc550ca140", "value": "6144:c8l0Cp/ryidXvpIFFIgtORZA/Y72s8UJUjp7GuI5vImxgI:c8l0EmidvpIFbQruM2s8Ua6hheI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786323107, "uuid": "be961110-b2b3-4cb6-9916-d68c1cba75e3", "value": 460412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786323107, "uuid": "3de95742-2fa4-402c-a88e-901c054007e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786323107, "uuid": "76d8ec78-6a2e-44f8-b241-1e179bccba7b", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4c7c3d-9485-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786343785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343785, "uuid": "f5b76903-20a1-4cc2-87a6-c55abc6c7c0f", "comment": "Malware payload (Mirai)", "value": "139fbc5243eacb544dfd44094129868d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343785, "uuid": "5d4f1060-7e6d-47ee-aff9-b0d4a7f45631", "comment": "Malware payload (Mirai)", "value": "c0d258fe8e23efd8b255d0e832dc8a2265c94b43b3ec994c4ca25b7ad3d2d59d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343785, "uuid": "94ab654f-a343-4736-83b1-725a7f665b68", "comment": "Malware payload (Mirai)", "value": "682994d77a16b25c967a363c329fa03bf87c9175", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343785, "uuid": "b6b2f25b-4f8e-4b74-9b3b-905cf6f2109f", "comment": "Malware payload (Mirai)", "value": "e1a637fea28e8672ff35ab6e9b97185794c0d22b0493bd5e23761236ea0ed97229b9969746d0f2abba4b2f9ec0c87361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343785, "uuid": "5a8edb42-af7e-43b4-a8cf-05e8972a54be", "value": "T1D303D8C2FA5F8606C2C271F7F75D42CD3F2A6EA8A3F9321659316FD123829D12935126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343785, "uuid": "df363f47-93bf-43cb-b2a9-4426afafb9a8", "value": "768:3goPWCg9bCURbOO7MoudPxUQ+JdHQFyZpLLvCzDKhUnIN2:wzT/7tuVGQ+4Fy/LLqlY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343785, "uuid": "f0342180-8a6a-4fa9-9603-7d68b143dbbe", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343785, "uuid": "1a5d8243-f200-4513-b16c-bdacdb141943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343785, "uuid": "39832f04-2bcd-4990-89a3-38f058b82d64", "value": "main.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454ecd73-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786371471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371471, "uuid": "d14b0b9f-c0ad-4907-bc99-dc2f279f780f", "comment": "Malware payload (njrat)", "value": "8e9e663128de583fa9dd061907ae2cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371471, "uuid": "6318edeb-75bd-4b50-b68c-2cc3ec894c96", "comment": "Malware payload (njrat)", "value": "c12fa949fc1e4c8ccc2eb96c0fdf4735320625c3fc6f7feecf84f6dcd2489677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371471, "uuid": "dfd34d1a-3809-4cc2-8892-a7434292a198", "comment": "Malware payload (njrat)", "value": "0c3798e1f696ec229c3820952d78e6561bb29a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371471, "uuid": "81bf081b-5122-4870-9e3d-c166461ecb12", "comment": "Malware payload (njrat)", "value": "8b17bad1b4b339d4a27c15f56b1175b3d9cba250d964b77c9b539f982a75b289efd2003ead38c7b4be4b77a2faf5a5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371471, "uuid": "332e4907-f389-49fb-b4d4-86b3fae08aa6", "value": "T1800512A86A20E813C1A567340EF1F675136C6EEAF940E7135FEC6EE779369165C002E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371471, "uuid": "41d498d7-5d78-4298-a477-4ab7146d4d39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371471, "uuid": "b9338d20-2585-407f-87cd-1e8a3657a24b", "value": "12288:wUU5UrS/k2bpWoLtaVeotX6c7dizOmkFShaCu9sCk6ZHQqesPNv:wZkNoxieotX6c7czjf47k6ZF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371471, "uuid": "04686e9e-e117-407e-9997-ccb0de24df6d", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371471, "uuid": "e9453089-6840-406d-aeec-180939449faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371471, "uuid": "47cd4f85-49fd-4297-931b-6186d418a702", "value": "c12fa949fc1e4c8ccc2eb96c0fdf4735320625c3fc6f7feecf84f6dcd2489677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0e21cd-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372588, "uuid": "e0d301eb-d6ad-42d8-b4e1-7bf8241c7184", "comment": "Malware payload (Formbook)", "value": "2781c66a3dacba3d64047f32c222907b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372588, "uuid": "d1a564d9-ed0c-4d24-9852-7737d8676899", "comment": "Malware payload (Formbook)", "value": "c19250d391296e4b5b04f04f7ef54a1220aebd6a48a3e0ea03b499ce183c08ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372588, "uuid": "8a182355-9560-4c9e-ad66-915dce5a4ff8", "comment": "Malware payload (Formbook)", "value": "a7e4090b312a7095b95cdcb22e9d66ab6793cff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372588, "uuid": "8306469d-9b40-43c6-8463-f1e1542d2b8f", "comment": "Malware payload (Formbook)", "value": "53f6b42ffa8759a8a1e24a396f23fceefb2ce0e20ebd45ed632c8a2ee28681e11214b8fc0cc0a5c0cade517c1005861e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372588, "uuid": "a304193b-3598-4eaf-9f8c-66a2f04ce6db", "value": "T1F63501541356DA42E0E68BF6A871D37432B80DDFBAD2C3C69FE96FF778283806554182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372588, "uuid": "357e35b1-aa76-48b6-a32c-4d5a9c684d82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372588, "uuid": "f10f66ab-60fd-4195-a13c-2eaaada1defc", "value": "24576:1p506IEipGQ4xLjALW7TOasIrJ5DCjhZySyT3Ykne:1pbI5pZIALW7TOEbDKQSIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372588, "uuid": "8fa2837f-2fcd-4ced-aa9b-32e9be4d8517", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372588, "uuid": "60de80d9-0355-433e-8738-d5fa102e831f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372588, "uuid": "2be9fc7b-edd4-4e96-81e7-64c7022b2b12", "value": "c19250d391296e4b5b04f04f7ef54a1220aebd6a48a3e0ea03b499ce183c08ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce863bb9-9485-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786343784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343784, "uuid": "d65b4dff-f0c7-4028-9c43-7afa124540e5", "comment": "Malware payload (Mirai)", "value": "e85ac8621444529b9c563ade6cb7fe06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343784, "uuid": "58227006-4011-4dc0-872a-e55b2edb6ecc", "comment": "Malware payload (Mirai)", "value": "c1bc5c236ac09f9bb74d2b2df4dac145da1afd6edaf9405cf7bce133ddd0459c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343784, "uuid": "1a303e53-b957-455a-9ca0-736ae78aff11", "comment": "Malware payload (Mirai)", "value": "7ed8313ec1cf64e9a969ef1bd0c162980c37f2b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343784, "uuid": "2518afa9-c650-4541-8bdd-3541cb202b61", "comment": "Malware payload (Mirai)", "value": "9e6c65bf7ecedc877fa7c560e9252bd85f1f584c9ea551ba1abb25bd46671696729d71f60e863975e3d1d684969fa9b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343784, "uuid": "d319dfdf-de73-46fb-87ad-585f299e57bf", "value": "T1D3B43B52F8519BA6C6D12ABFFF5E828C731317B8E2DE71129D164B2033DB85A4E3E141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343784, "uuid": "d4bdfcd2-6c6f-41b9-8b28-945bbcedd9df", "value": "12288:28feDPIOAbMvtEZeDcZsAVIuIPZLg1o2TNh4Vfkgob5e:ZoPgFZXKejn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343784, "uuid": "3db01a36-b06e-4aa3-8c94-33e0c2ba48f0", "value": 516064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343784, "uuid": "493f4e89-3f26-4f2d-8431-b3ce197bd32c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343784, "uuid": "ae526d78-0948-4d5c-9a3d-34b510a2a6e2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567a859a-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786355608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355608, "uuid": "9dc933e8-e48a-4efc-993a-fe0837fb42a6", "comment": "Malware payload", "value": "4d593cf1049992e43b55e1ec2fd3dd10", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355608, "uuid": "70f3c6f7-74b1-4ee4-b2a3-bfef056456f8", "comment": "Malware payload", "value": "c1e66135ab5b78d1f91092db8b230732cdbc7b15657b6a4b81bf6113dc901912", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355608, "uuid": "7a537502-ab78-4f95-9af3-702116e86911", "comment": "Malware payload", "value": "32caf6f2e0f6772cdd62a2b267f7312fc7322c73", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355608, "uuid": "be2b19a1-b95e-4a4f-b82f-b340e98d346d", "comment": "Malware payload", "value": "b5b4ad7d3941f88ad6fc631251c773b7de59f6555fcc67c87d9dcc5d3890acdb623703349be2fae2b244ad1e5e419bf2", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355608, "uuid": "327408b0-a24b-43e8-83d3-5e6ede38de41", "value": "T16E151202FF858D72D58A53360BA761C5D72CFD17EF268A0B2345732E7837AA1C861D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355608, "uuid": "bdfdf401-7085-4718-990d-698e94797f7f", "value": "24576:JbLSv9e70NKYt1QRT/64rmUfvZM7LGKxg8+:JbLf0NKYtmB6vPBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355608, "uuid": "d478bcf1-6752-4a7c-ae88-c94b94821a6a", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355608, "uuid": "554b46e7-fa30-4bb7-a966-76ac356912dd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355608, "uuid": "986f902e-87ec-493d-8457-724d7fd5f0dc", "value": "Payment Slip9570-6758636.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27d200d-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372942, "uuid": "92d3a004-3786-4d17-b372-9d27a75f1d01", "comment": "Malware payload (AgentTesla)", "value": "571e155ebb3b4f5ef2764f262e3569fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372942, "uuid": "d96b9eee-d348-4aa2-9d30-6b39f96b2dc6", "comment": "Malware payload (AgentTesla)", "value": "c21f6749bca94dcdb0c7c83b759e5f5a93861dff4f6d76ebace099d91a69579f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372942, "uuid": "faba9e07-2f37-4a8c-99d4-b0f825383358", "comment": "Malware payload (AgentTesla)", "value": "d5629e1a72116fd527d13eefc055d9a3b5765af6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372942, "uuid": "0ee05205-8a07-4af8-9620-42ef728db7ac", "comment": "Malware payload (AgentTesla)", "value": "e30c380f73148b35185dd65a9d7e3df2b844db33e17ba1bc26c31c23803e484ad4796ad64d98f985ca45fe3eaa4f3ce1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372942, "uuid": "ea91212b-418d-44fd-acb0-a8fb676cd58a", "value": "T11155F141A2168841E8E187B2A8B2CA7522673DAFB9F1C18E5FDD7F773B733C14494642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372942, "uuid": "48194b66-3f46-415e-b7da-9ba000951e74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372942, "uuid": "d9b2931c-4071-4b7c-9c48-73d9ebbf714e", "value": "24576:qMI1p50LpK6z/KWG+Y0quNUkKOM2vWzA3Fk+cBS/UFRHKkPfXB3m:qM0pks9W7Y0PRX0A32+cB0UHHJXdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372942, "uuid": "2b6d8a11-2e29-470c-b745-adcecf350016", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372942, "uuid": "a17d8bf5-517f-4534-831e-f4d4bfe4927c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372942, "uuid": "4e79139a-1c4c-4ede-b65e-41bc0993bf0e", "value": "c21f6749bca94dcdb0c7c83b759e5f5a93861dff4f6d76ebace099d91a69579f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b479112e-94f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786392273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392273, "uuid": "0964c93b-ca7b-445c-bf9f-f4f789ba094d", "comment": "Malware payload (Mirai)", "value": "130170c0c5e61947931f261ce82d2f42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392273, "uuid": "db6bd059-228a-48b9-98bc-443be152bf0f", "comment": "Malware payload (Mirai)", "value": "c29f7ea6eaf0203f9042ffd196b192acf1953368f898278a96443071bdef5555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392273, "uuid": "355402ea-a291-4395-aefc-f821485237e6", "comment": "Malware payload (Mirai)", "value": "d2953f4c3623f2cf6b0c5f15aa930c0d6dcb5b3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392273, "uuid": "27c10a00-625e-45b2-be6d-2ac3cc5c8adf", "comment": "Malware payload (Mirai)", "value": "6c082ad6fb46e8d75b35849c6b6241532fe2f8fe9a9f61fc76743dd5fd1f33beb0fe84919025e80dbedc1f0449f39037", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392273, "uuid": "7f502628-0785-4681-b394-8411615cdf43", "value": "T1E8D32A56B9519B12C1C321BAFB9E914D33136FBCE3ED72029D14AF60274B8DB0E76912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392273, "uuid": "9a0937d7-5b4b-4788-a78b-f5e2ef220b3e", "value": "3072:i/bdN0ZqByS3hHe+mjPERBUlifWCOa9lJLyZy6M3k/nsIq:ijdN0Z7qhHtoO6wfWtaLJQy6LnsIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392273, "uuid": "38b03091-84d4-44b0-8e4b-ef14f7af59f8", "value": 134280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392273, "uuid": "f0dab750-9691-4f0d-aa2f-58d18c46f438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392273, "uuid": "d3b61e43-ab72-450b-9679-239d29b527cd", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79defba-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369086, "uuid": "7731f08c-05c5-44cf-9459-84b23ae5c1a9", "comment": "Malware payload (Vidar)", "value": "51892a789a77f8d01d0116d776611157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369086, "uuid": "e952e3c9-f1fe-44c1-80da-994ad7847804", "comment": "Malware payload (Vidar)", "value": "c2b61d34502af3e1fda0b497768d1e14a21eaf151fee2113158728285c343427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369086, "uuid": "6da2a637-c061-45d3-ab17-d2d4f42dc022", "comment": "Malware payload (Vidar)", "value": "251e37a11a79395e4f725bda9c02573c50ddc96b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369086, "uuid": "626ec03c-745a-44df-ab35-cbfa7aa77737", "comment": "Malware payload (Vidar)", "value": "11bd40a06c239a0651e18cd67ec4d4a1c2e615ccdf029319e04c444636e4902d5807d68f7dd4927ad6472df7f9072287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369086, "uuid": "b28bd28a-caea-4319-b2c4-34655045b74e", "value": "T11F424B8971D5E178E0AEC578D47E06BB8963341607225EFF3BA088113BC6636F778A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369086, "uuid": "219c1979-181b-4054-9a40-f42c9d78b927", "value": "f9ae5e857e8014c538b4ec419c186fce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369086, "uuid": "1dc5ca83-5b60-4ba6-b4e9-df5f3889aab1", "value": "384:OOae7vVZTMom1MGd/phKrSebdXa3Q1jgnl9:va+HMo+/pheSzQ1sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369086, "uuid": "3e7aa63d-09d5-4972-bce4-80c0ddac11ad", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369086, "uuid": "44acff3a-9aa6-4aef-9292-95bf5f5a49cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369086, "uuid": "0e642f32-7589-424b-ac6a-3f5c39681387", "value": "c2b61d34502af3e1fda0b497768d1e14a21eaf151fee2113158728285c343427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947720cf-94ba-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786366450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366450, "uuid": "fd544be2-0068-42be-bac0-6e408c26ae12", "comment": "Malware payload", "value": "f0151fd77001c5ec63bdf04b0c5278d6", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366450, "uuid": "c7f6bf4e-c26a-4f9b-921d-7e00548ff402", "comment": "Malware payload", "value": "c2d1a731986c705ce035969b00f8fb6329f6511053019708274df31058ed3a3d", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366450, "uuid": "668e2f95-eb0c-4319-8fda-771fa5e543e7", "comment": "Malware payload", "value": "ae0c77b089678eea397b702c152e7a52389c30c7", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366450, "uuid": "f4e7738e-1946-41fa-9da8-3e5a51cedf98", "comment": "Malware payload", "value": "7d83d2d065e070a0dc11dc8207d4d872c5f3ad7f523cf10ee7f8379c1f5ccc91ad096963ccd989a0bef3c52b2e66ba07", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366450, "uuid": "d8a42349-ffc2-4f4d-ad05-2efc16535283", "value": "T1CA08DF1663E112AAD577D138C7AB6603EB72B407133087DB329C43652F73AE45E7AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366450, "uuid": "5414398e-c2d5-4549-809f-92367b669e92", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366450, "uuid": "c2ece6f0-a9fe-4c9b-a085-7d2f7351a5d4", "value": "786432:x1VDG3sSMiP2aCCTt3IUf/zUNUgPV1szg8iYjHmxc9j4aIgpx3un+o/ZNnAkNt3w:HVDG5MiP2aVxUXd0jHmy23/ZNnAy9Rwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366450, "uuid": "5a1451f2-f97f-4c25-9825-4d3d6c94c800", "value": 77651277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366450, "uuid": "2bdb3f77-270e-4f8d-a349-4c6accb2f66e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366450, "uuid": "0386702b-24db-45b3-9553-254a5436fc41", "value": "Vozolomis Setup-1.2.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca89c89-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340049, "uuid": "2b99811f-149f-408e-abe3-612ff39d527d", "comment": "Malware payload (Mirai)", "value": "fd5257e975e777f0fd3bc625e729e0bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340049, "uuid": "92eb3872-ed12-4b93-b547-a75a3f697a6c", "comment": "Malware payload (Mirai)", "value": "c3d9376da70df737d5c55bccf418b4a77d085666d0a7dc0efd4ea24b0590e105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340049, "uuid": "83f539a3-556a-4269-9b9b-6018dc153b76", "comment": "Malware payload (Mirai)", "value": "e8a49fee6b48254b655d572d241a0f33e74611aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340049, "uuid": "4e4d383c-5f6e-40ac-930f-a823c53dc319", "comment": "Malware payload (Mirai)", "value": "82b8f8c13a58684495018e83e2799d57f89d636982c1883e41fdaea001cc787b3064b8a209b9da628f43b22096b3acd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340049, "uuid": "3850057c-f026-411c-869e-f2c6df29b722", "value": "T156741A48B2F1E3EDE158E5705319BE1B4C72463730937686F39EB97363A718046E9A38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340049, "uuid": "1f6e5110-e660-44c3-868c-3a2db44117c3", "value": "6144:Va94a93a9lnTlVUh5bEyKKjjGfbJ4g4tkHCw/+rTHM:Va94a93a9lTAhZHjjGfbNTCwUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340049, "uuid": "27aa9563-2a98-4f51-a828-c9032e3b3187", "value": 354620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340049, "uuid": "4c40ed2f-5371-4e3b-a8c1-eb2091932ab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340049, "uuid": "b8be852d-b825-4f5e-b73f-4376a13ba2e0", "value": "pid.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4490598c-9452-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786321648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321648, "uuid": "b361dc2b-02c1-419e-8a81-6a0c32109ed4", "comment": "Malware payload", "value": "3895165fffb52ebe47b0b5a7755821af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321648, "uuid": "bf6c0b50-6bde-41bf-a9f8-3e839a898d57", "comment": "Malware payload", "value": "c414e83794ecb9ed7fc4f39b2b69ac84473721d622fa09c6d565852e777b0e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321648, "uuid": "4990a76e-ece1-40a6-9f51-0586cbc6cd32", "comment": "Malware payload", "value": "be9a6c29e0bd8643f535fd5fea761309b3f2a1b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321648, "uuid": "7a7aa11a-26b4-4c8b-bdb9-a1e62cd10828", "comment": "Malware payload", "value": "3cfce36da737ed5ec21a4676f48f7a566292c154412c0c1863c40a9a3927791b5f8f766422278739ef7e4b38c68691a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321648, "uuid": "1eda61c2-44b7-4eb9-bbfc-fe3082996ccd", "value": "T1F6947C26FB640076E167D538CDA34901EB727C8E43209BCB23A94A965F63FE05E3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321648, "uuid": "f4cba415-b769-485b-bca3-d7824d6c6512", "value": "62cc1d574bca5325a51f5b7373f96626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321648, "uuid": "027caa42-900e-4835-a811-c2ddbb21af84", "value": "6144:wDDlrvrSNMzVo7RGIESJAJzkePxyOr1xdtp2TlMPpQs4:KxvM7MIESi57r1LWTlMPpv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786321648, "uuid": "c640468c-0618-4ee2-8e18-e653202740e9", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786321648, "uuid": "ffa10f18-2460-4f5a-b105-4eae8488a1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321648, "uuid": "415c338d-0893-452c-8ffa-e43d16f1d2fa", "value": "XBDTGO.464.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac8d4fc-94e3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vjw0rm)", "timestamp": 1786383908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383908, "uuid": "4d6ad3e2-eeb0-4a07-af48-9ed3cad223f9", "comment": "Malware payload (Vjw0rm)", "value": "fcc362983318f26dd131fd9a915c63fc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383908, "uuid": "4d4124d7-783d-4aa1-804c-0e0663008a0e", "comment": "Malware payload (Vjw0rm)", "value": "c449d4a7e46b0848b39a041665cd4a2d6ca2e62c6fcad7cc745b92b01ad1e8c7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383908, "uuid": "0c72b8be-b443-4a50-9f4f-f4d95096888c", "comment": "Malware payload (Vjw0rm)", "value": "0d83267cf91584da3c52927ef45362d2f451e40c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383908, "uuid": "0e607fb7-0817-42c7-92c1-c6c333a8a289", "comment": "Malware payload (Vjw0rm)", "value": "77e647195addec83fdc3c75e2eb2fb72db31b1e9e4b77d6c2247f37e72a725f3133229cde9c0f3f0e1d089969f163572", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383908, "uuid": "2278ce67-e41b-460e-98ad-cf3892ddd6fd", "value": "T11CE4D0157BCE0DBC06C81B9FA23ED1ED93E3A14A6315386F686B70D8065B751DC2EA13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383908, "uuid": "e9b6459d-704f-4951-98e5-4a728ed758af", "value": "3072:MAOErT6v7M31oc9SACVgaEk/kDcbbWnvUhC8U6nT/Nk2JD/54T8VY64THfYSyyC4:ej1uxlkJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383908, "uuid": "802980c4-e19f-4820-a9aa-9418a1e77007", "value": 657840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383908, "uuid": "85086192-fd83-4922-a352-8167c1874dd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383908, "uuid": "85c3074b-23d8-44fc-9f8c-b262e946b52c", "value": "ORDER #26810-408529.XLS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b133ac-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369196, "uuid": "47b21fe6-ab2e-4abf-a7c3-d1da341d66ed", "comment": "Malware payload", "value": "615fef778f52a3bb7f7691746081aa92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369196, "uuid": "d9abeeb7-8e8f-4e0f-98fa-36911cc680f1", "comment": "Malware payload", "value": "c44b27ca852ad7ae478c9b43c8322c84799355e776c53caa0f22c6640272ae7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369196, "uuid": "f979c260-407e-4506-b204-68539d4d51f2", "comment": "Malware payload", "value": "64eb9b8b5af27e4a14ce54bb9a7fef707af691c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369196, "uuid": "4f52ef3a-36a3-4e51-a7f8-8efcb476079b", "comment": "Malware payload", "value": "913268bc7b001060b1eaff285d3edac1bcd739d5d5e22e313ae23928f6ec691e121eacb7cfd852137103c48d6396e71f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369196, "uuid": "6027052e-8002-4100-998c-38131261df9e", "value": "T18084CE83F680C6A6FD3C4C75D59792701B72ADB686895B4393E879123FB22C0353B52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369196, "uuid": "73a0bc75-c33a-441e-b391-5b6f8dce4ab8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369196, "uuid": "aeaf55a0-2fea-430d-b86f-dc3aac35955f", "value": "6144:imGIhCrl0WKxHId8CXXH7YLeAr12xZgbzGqU66X0vGgrilq56zV:1m0NxodvXEzqgbis6X07GqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369196, "uuid": "13af2a6a-1fd2-4a61-a500-7abc5f136c82", "value": 402384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369196, "uuid": "d607b635-50c0-47c4-b2ca-ba96eb55ff8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369196, "uuid": "d219658d-f940-4fdb-8e2e-da010b4be7ec", "value": "c44b27ca852ad7ae478c9b43c8322c84799355e776c53caa0f22c6640272ae7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c1f1c9-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372817, "uuid": "224d1223-2f31-49f0-a5d7-ae5cb93ff3e9", "comment": "Malware payload", "value": "920883a16b8544499b06a81958dd069d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372817, "uuid": "f2662983-7549-4c0b-b868-a13de3b1159a", "comment": "Malware payload", "value": "c49a48f2d95a351778bde4f6c4025bd368d863138ba5fd674d81a6cd9a18cad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372817, "uuid": "70082199-612b-48a7-ab5f-9af17c0f65e2", "comment": "Malware payload", "value": "4e3b558da9bed4d0db50b9b89b879e76a3302cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372817, "uuid": "1c6092e6-9265-4fa0-b9cf-7fce8d8e4f91", "comment": "Malware payload", "value": "3312243b367e1fb650c2aa40f51a3d0680282d74e16ef13486f966f88390b355c9d2f45d20de12a97a2b188a610a73ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372817, "uuid": "c07470c3-c68d-4e9c-8c27-1e3505c96686", "value": "T1013501368E832B04C57D6F74C162559473F0CC0B926AE75B2EEC10F99E62B86CD2B952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372817, "uuid": "6b11eabb-ad87-4837-9194-6c09f21a273f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372817, "uuid": "40e2c61a-fa1b-4847-82e0-e094b0326cdf", "value": "12288:VlAjrtHf4OFyLHK9Jwe4ezKWusA8Z2vjtxIcYzLzPZeGRpQ6s7Ewaz4RH6/Vq:0aOF8HKLZ4e2sAh8cYH4iKszyoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372817, "uuid": "0321d298-318b-4715-a763-39487a684c79", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372817, "uuid": "f377d129-bfe6-46c0-a8ce-e3400c216137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372817, "uuid": "bd95648d-656b-46d3-be51-7de6ad43ced4", "value": "c49a48f2d95a351778bde4f6c4025bd368d863138ba5fd674d81a6cd9a18cad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71084ef-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372198, "uuid": "6caeb5b1-e8d0-4169-95e3-5aaa1c7365c3", "comment": "Malware payload (Formbook)", "value": "f37c7a7acdf7c5cc397e6931eca075f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372198, "uuid": "ac0e4572-8b37-4ab8-8401-58b721ee6d4e", "comment": "Malware payload (Formbook)", "value": "c4b1b2d82beea8ab9cc8feb1ec2f47b645b3017280f7a8c752a939f96cfd323c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372198, "uuid": "4bd20ef2-1f98-43ce-b2c4-0910267f3e16", "comment": "Malware payload (Formbook)", "value": "27a7b50a2546632cbec807d130cd01d37f8d403e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372198, "uuid": "80af90b9-9c47-49cf-897f-8cabcc53582e", "comment": "Malware payload (Formbook)", "value": "e1955fb3a76a4c8d99b9ddd9fa26762b7a46fd35483365cb5a9d82d5d5b24dce8a6d287b15ba00e2e64e2b7206882d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372198, "uuid": "33ca81f3-9662-43a5-bc20-7fa4d6a88e02", "value": "T114351214A79BDA12D4650B72D9E2E2F503B28F14F613C2AF5ED9BED37A333960D50242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372198, "uuid": "4c65c2a2-d0da-4c7d-9849-8a0da536d8dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372198, "uuid": "cb4adc2f-59ef-41d4-a664-56be36e992de", "value": "24576:Ud7GzDWmWpTQfY14a6X2LHxDlrqMYh4VKg0CjqoP4:BmNsfY1221lGo0/Cjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372198, "uuid": "9e75d724-47e2-4599-8198-0a37f56f794b", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372198, "uuid": "19febfbb-0ea6-434d-9d4f-4a499c804920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372198, "uuid": "04862881-c9f2-47cd-9585-ae05bde6dc4a", "value": "c4b1b2d82beea8ab9cc8feb1ec2f47b645b3017280f7a8c752a939f96cfd323c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76c0570-94ea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786387231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387231, "uuid": "4c40d21b-107f-4018-ab6c-95d0fef646c6", "comment": "Malware payload", "value": "e85fd4fe983ac24a03f24b7717fa29df", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387231, "uuid": "e4f63a6c-55cc-4ff1-a660-a289294c1b83", "comment": "Malware payload", "value": "c4ce4a7adb9483bfae8aa438c97b0eb3d7cd33d6363c3653702940f994f1b46d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387231, "uuid": "6a9c29eb-145f-428a-a1b3-2da654c2454d", "comment": "Malware payload", "value": "f4d5b43f848946ab08811da54ae4dcd433e55728", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387231, "uuid": "3dc60907-c2fc-4671-a179-fd19a0b81e98", "comment": "Malware payload", "value": "692b2a6012271fdd48ec22516da18f80a9bf41e03ea622f4c0a919522e0ab00d431a1e82ea945a18e62c581a3a2761d3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387231, "uuid": "dd6991d8-4f2c-4828-9d5b-ae3c5f4752f7", "value": "T1A63633493987111DCCA523F1AA454C8AC49BA3506BB3F1A7BF4FFD1C27251CA129CDAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387231, "uuid": "74913034-33ff-4a94-b46b-f7adc0db4c5f", "value": "4e18265a4646503e3c069aad9d7f48b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387231, "uuid": "96f4324e-6c3e-4bbf-bdbe-cab473263eec", "value": "98304:EBpexm3AraPleHvxOF9L5h4Bfvx3KV5IN3MO8/3j0o2coZ4I:EAm42A2h5ShKoNcOY3j09Z4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786387231, "uuid": "f3acf80b-2886-4b92-b8b7-3203fd96ff70", "value": 5111672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786387231, "uuid": "2eab4270-73b3-4583-8a19-d894b052178a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387231, "uuid": "9edccb44-9514-48eb-9d38-a1cb4d2a5f4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3df99d-950e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786402349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786402349, "uuid": "4fef413b-d419-4186-b6c4-596b66f2e652", "comment": "Malware payload", "value": "b5af079e5ff8b217a75f4a63945f33a1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786402349, "uuid": "05fc56bb-968d-4b15-8c55-2c64b084250f", "comment": "Malware payload", "value": "c52bfa771cc39d666af26400fb68906a4c5c22d88d7ac1d85cb6be0b728c900d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786402349, "uuid": "7240d7da-8042-458c-938e-3ed341f0debf", "comment": "Malware payload", "value": "fa68a3d4de4131a9b355c67dec6c2c7be82b3707", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786402349, "uuid": "e1bcde51-c7ba-47bf-b4be-f444704e18d3", "comment": "Malware payload", "value": "0008ad6008a997491581e351b616aaab3202040cddd9456617384e102f90e0ea0facc960590e0db11e5a9a58c7ab74d0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786402349, "uuid": "889bbf11-bd34-46b9-a470-61661f5dc211", "value": "T11BE633186EE001FEEE73463DDBE255A4F874B4624372C89712BC53A15E632F04A79B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786402349, "uuid": "532ce157-25ec-49bb-81be-1ace40b8d403", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786402349, "uuid": "3d5b2b3e-733a-4797-8213-057e500351c6", "value": "393216:GYERDtzzbgCepGEvA2s/bjDWT9tXMCHWUjkcuI3/PGTAI:GYOtPEps/3SHXMb8xH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786402349, "uuid": "d1db019e-dd97-47a8-8f68-3d1cd072a240", "value": 14074508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786402349, "uuid": "cc9dc3ea-f592-4c48-b4f9-59751e7d6259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786402349, "uuid": "b9725e43-eb42-44c5-924c-e4e5fd0a6038", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedc1636-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339919, "uuid": "bee74cdc-a7b4-4be0-84e0-29fb16a1ef6c", "comment": "Malware payload (Mirai)", "value": "cf8faa6bbdd9d3b55177364d06dcff4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339919, "uuid": "c1a80fc6-2e60-47a0-9e41-2d6798cc8d44", "comment": "Malware payload (Mirai)", "value": "c5579164d38899b40940b7396dfb5c5d7f9abc6b4cf8d1623f71a60ce188f0f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339919, "uuid": "bbe10666-0f9a-4ed2-881b-13a72b38c85f", "comment": "Malware payload (Mirai)", "value": "05396efae4e1b5a3a1ec1b3394e9fe851379cde6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339919, "uuid": "2a2f8e8e-adbb-4dac-9548-f997c324fb55", "comment": "Malware payload (Mirai)", "value": "0a015e2a90bdda5576bf971cfc963c909dfe26064a4ed85ff48e298b4c72260166d5b351c3305a378ac226a37bd4aea1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339919, "uuid": "5b94d7db-35a2-4ef5-9563-dd7592eb7574", "value": "T16884FD9CB5F2E2CAD1D4EA75B319784D37630736B1D73146A50EDA3322EF19809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339919, "uuid": "4c5d561c-9268-4406-882b-f67c5f36f7d2", "value": "6144:aa9Ma9Xa9SPicUgBm/wnB/v27S4sKJeXyQfQYkf/7:aa9Ma9Xa9SKcU7wnwNQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339919, "uuid": "c4dba99f-68df-4997-915c-675907595b5a", "value": 372328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339919, "uuid": "7c4b78de-ea4a-40c9-b5df-9241f1273b93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339919, "uuid": "2310a20c-284b-4fb0-8016-363756dd7c4f", "value": "pid.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632f4ad8-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368514, "uuid": "193bb97c-bfbb-4bd1-a0d4-21799d48eb13", "comment": "Malware payload (Formbook)", "value": "84ef409a2145dab14211a1cc0a9f00b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368514, "uuid": "eb27fab6-9280-4f13-8d02-a318c7c8ee23", "comment": "Malware payload (Formbook)", "value": "c570e8784543f94b9ebb4ff0b4695ca0cc182f700b4f7e0cf77385467c32c991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368514, "uuid": "960fadb6-fc9c-416b-a56b-b55029b5cef7", "comment": "Malware payload (Formbook)", "value": "d9793bfe25e220b6b20f06506111da6fbc09fd89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368514, "uuid": "9fd579c2-a2f6-4ce7-8bc7-4368f0365fef", "comment": "Malware payload (Formbook)", "value": "fe4d1ad4606327f44520750e587e451bbdc4b642b4673acfc1a5365b888e91ab8aa75cf734ffbccbafc49452b1510a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368514, "uuid": "d062faf1-e983-42ad-a4a4-d922d45a39a4", "value": "T19A35F1C037657B19DDB416349935EEB582FA3E69B020F5E61ECA3BDB796C6005E08F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368514, "uuid": "e6e4f12f-fe19-424c-ace8-7bacb6244cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368514, "uuid": "af516eca-c090-459e-a557-5f86a2a0be09", "value": "24576:oRAJSFBwIqJU/WSi62HCfOwdJphUG1GHKo3GC0mn6qJ6IP:rJC//WS9exw9+G10Ko3n7JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368514, "uuid": "fdb7baa1-f9f0-48d3-8e8d-6c7012c0988c", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368514, "uuid": "ab27a833-4db1-43b7-a145-b9fa31c59ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368514, "uuid": "1d6d9447-a08e-4579-b20b-31fa43c7ddec", "value": "c570e8784543f94b9ebb4ff0b4695ca0cc182f700b4f7e0cf77385467c32c991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c423c9d9-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369536, "uuid": "ec6365ee-d62a-49e7-a1d9-597e81c607e2", "comment": "Malware payload", "value": "7f9f13d50c484f173aefcb91f82ae8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369536, "uuid": "778cdabf-3c06-42a1-8473-943b27012ae4", "comment": "Malware payload", "value": "c5d61ad96a71cd134e3780869061b8a244eefad6bfc975b14fdc79102ce39942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369536, "uuid": "1c6f78cd-1607-47de-9a77-e378019d3d04", "comment": "Malware payload", "value": "16f5d5e06f2f3d7e853b3816a6b131355c3aa1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369536, "uuid": "5fe7da44-046d-4a02-9111-746aca9ceaed", "comment": "Malware payload", "value": "3b809e4b4eaa371241818735b97577554bc4b168ddb30d72508a990733f0c475f7fb4ddb494876ed04cfc942c73fc441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369536, "uuid": "8eb01859-5af9-4c12-8b49-aa1d3805e9a1", "value": "T1B335F1191E8A6B99DA7D5FB4C166189837F0D8439396E7272FEC11F58EB3788CD0B402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369536, "uuid": "4c25c76d-886f-45f8-95ea-f256f991405c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369536, "uuid": "ede99cce-842f-4808-bc02-0afbfdde0c09", "value": "24576:X0qqigNf0NSIXtbJXsFxWHVALNUSzkQON:X0qP200IpJXixW1ALmfQON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369536, "uuid": "f1c9b650-c6e5-4f1e-b3d5-1d88afebb248", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369536, "uuid": "d196165b-ad58-40b2-94fa-82c229b1ac65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369536, "uuid": "994ec80c-f20f-4799-92f2-615af90b81f6", "value": "c5d61ad96a71cd134e3780869061b8a244eefad6bfc975b14fdc79102ce39942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b80d173-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372340, "uuid": "ad42cea4-0c34-4ff3-9021-8ca3219c72e6", "comment": "Malware payload (RemcosRAT)", "value": "7f6646bd139d7c4290ea8b89052406ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372340, "uuid": "f69e04bd-f4f9-47fe-800f-f58fd25a644b", "comment": "Malware payload (RemcosRAT)", "value": "c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372340, "uuid": "656c4fac-3994-442c-9b18-7639da742b6c", "comment": "Malware payload (RemcosRAT)", "value": "c54e240884fcf8d22055a133dc8792827e1a0bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372340, "uuid": "1f94043e-c261-4621-ac9d-1688d1732b62", "comment": "Malware payload (RemcosRAT)", "value": "e49b0b19aa0b227b15c5a987d391aed1206f5fa73dbda8245517d686f099bbec5e08c16f8b1491951f89737eb846e7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372340, "uuid": "5fd181e9-4089-4ecb-ad89-1d3ec82afb08", "value": "T1950512E563E9DB19C27087F018B1E0310B746C6EE830D36A9EE5ACDF7AB5B159850B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372340, "uuid": "21fa4abd-4d60-4ecf-bacc-bfe8c2edc647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372340, "uuid": "0d9f4182-5581-47e4-b6e1-921d1409cfbe", "value": "12288:E1afeGm/Og8CFhhjOP83pfVJJG6YuhmG36r2KJemxB0xVBeOeIfWvLH0y6slCVVl:dfej/Og3FpVBIcyHxineOeIf0Uy6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372340, "uuid": "ada1a22a-1be2-4da5-8f1d-fb9f0b11fb41", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372340, "uuid": "3839715b-fac5-4378-9553-dd30aeaed1bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372340, "uuid": "9d1ef358-0fd6-4487-8c78-d964185b25f0", "value": "c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d3fd69-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368462, "uuid": "104d06eb-295a-442b-8e17-272031974a94", "comment": "Malware payload", "value": "1984205e769c3ab7f97ed3f2590e2229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368462, "uuid": "b010db49-2265-41ae-859e-467e5a0e23d1", "comment": "Malware payload", "value": "c5fe0e3ac02d6409a52b2c3d7ceae63133618786f1335095f7d017321f22eaa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368462, "uuid": "bb6a4fec-1c18-46a9-9ef8-d038ffa3669d", "comment": "Malware payload", "value": "c047e4d1112f6428e93bc2c59f7a84a6f679f315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368462, "uuid": "0fd77212-8ef7-42e8-91cd-b8f8fbdfc0d3", "comment": "Malware payload", "value": "06c7409ea5da54cbf24e488812cfd1302daa6f658ca5c07a8937bc25249240e968617ddb34292a7b214a2d4d883a9299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368462, "uuid": "dca920f7-891b-4f6d-ad45-2d67e68103e7", "value": "T14864D02887D48A16D7AE5BBCD0294A068372918B7653F35E1FC1B1F62C37760CD42DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368462, "uuid": "e0302f86-49ee-4c89-80a8-9c6a94bd28dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368462, "uuid": "a66efd11-39e1-4903-8e5d-a17264ac0427", "value": "6144:f457QHUQXfthssQrXVzfgyviFuRTgWoGrel4JaV00fe:ecXhQbdP6FPke19W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368462, "uuid": "61002088-7b60-4939-8ad8-1037aea3b7f9", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368462, "uuid": "2190e3a8-c094-4c29-9efa-5af14a887a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368462, "uuid": "debd77a2-3c0a-47c9-abdd-4cba4ba5dcb2", "value": "c5fe0e3ac02d6409a52b2c3d7ceae63133618786f1335095f7d017321f22eaa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac36cddf-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786345874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345874, "uuid": "06adc3c2-3454-4187-8b11-a40b87961522", "comment": "Malware payload (PhantomStealer)", "value": "ff3dba3eb77d39424c674007b46d0959", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345874, "uuid": "289030c7-5a95-4197-ad0d-87010c7efafe", "comment": "Malware payload (PhantomStealer)", "value": "c662402a7f8ab334c42bf5b9efa9a0648e18543e785b767f38ea55fac0e1c334", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345874, "uuid": "a756f7cd-e55c-4772-999d-eaa51f68bf5f", "comment": "Malware payload (PhantomStealer)", "value": "ec8d0df311b592ef1c93b27f750510b3f68ec4d5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345874, "uuid": "9f4cf18f-349e-4094-b361-eea47442b51b", "comment": "Malware payload (PhantomStealer)", "value": "83a7b088e34a66ace357192342ebb6bfcb4b8c6bfc4d101fbcbf6a2d03f64c09fa699f3ae8675c82442c273341f45947", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345874, "uuid": "88091988-fa17-471e-b6a2-4e6a0b25c976", "value": "T11D26195213859D32B725AB9C9636DCB0E94A611315C6CF29306CF2187B6CD1BE39CAF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345874, "uuid": "e6bd8984-da17-4ce3-ab0d-366fdfefba35", "value": "98304:DZpCTFylGMw7C/lN7i2bhtu1COrOkaViaizwfUSR+/yo+iJsMe2FtFFA8mLCELix:DZUqz7i2bK1CHkaZiTk+t3m6PECELiL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345874, "uuid": "a7caa568-1fc5-4524-bfb4-5eeeeae895c7", "value": 4818638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345874, "uuid": "d96b9433-0f96-444f-9439-a24bd81ae4e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345874, "uuid": "5d1c81d9-80b6-4e2c-ae6d-7729641c9aa4", "value": "119730954a.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b05854-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371773, "uuid": "9d4c9071-5c03-43ba-8464-d074ac3d5765", "comment": "Malware payload (Formbook)", "value": "8bd9248c567750229906b6182fcf2469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371773, "uuid": "f278708f-ff18-469e-8050-7ff85713dc76", "comment": "Malware payload (Formbook)", "value": "c679d82b20a7961aa6c4f68ce698a90996609185251d320487a816fd525dd496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371773, "uuid": "785f9ac0-177d-422e-aad4-5e9ac072dfd3", "comment": "Malware payload (Formbook)", "value": "a47ce63348937b16089d57229e4f94f877f99060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371773, "uuid": "82bf7d93-c97a-476a-aa6d-18377ac5db66", "comment": "Malware payload (Formbook)", "value": "0d275cadd2e5da4932e80adb07159185cee5d7e0d4383933178363597aa41889f6cdea39b768963a752a26d066aebcbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371773, "uuid": "99da9fb3-b980-4a82-acc2-5ca13dd41db2", "value": "T1B8252228E65BF503C101237219A2F1B6137D9FDDA913C21BABED6EDBBD31B168944182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371773, "uuid": "15a835b4-dd2c-42bc-b617-06955ae94dac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371773, "uuid": "7cfb6c8e-e54a-491f-ae54-19a94f61c159", "value": "24576:te/7oUxXN/1x95UERUmSO98RbOsrAg08NAbraA:SHxV1x9pJS7dOea/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371773, "uuid": "1c12f68e-d581-4820-8537-b38169215123", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371773, "uuid": "fb89f8f5-b1b0-40a1-8560-38a4dddaf1e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371773, "uuid": "150eb244-57cd-4cde-b84c-ac8201f9a726", "value": "c679d82b20a7961aa6c4f68ce698a90996609185251d320487a816fd525dd496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2742831-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368298, "uuid": "b5e23659-aa78-4e9d-93b9-cdaab35abe77", "comment": "Malware payload (Vidar)", "value": "57eb2fe435d796d1337cc09d84a5d2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368298, "uuid": "c34a25d7-b026-43fd-87ba-3691f48707c1", "comment": "Malware payload (Vidar)", "value": "c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368298, "uuid": "cddff57f-9f0c-4723-9311-2c2019639bef", "comment": "Malware payload (Vidar)", "value": "8517ac69f351f77fa5fc90026b218e02a0518143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368298, "uuid": "94debf88-c6eb-4d49-8633-11c95ac4a951", "comment": "Malware payload (Vidar)", "value": "0cfb5eb20c942a1838dcc2c7e03c93745f49774881cdd210c13f1ce170af0a72cfd01facd3155fba960ecef516d49b4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368298, "uuid": "ae65efb6-05b3-4a8b-824d-00236a527995", "value": "T1E6826145E15B9AE4C4E1C337636A429755F8BC2432725A7B6BDCAB2A4D42330F7502EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368298, "uuid": "bd410c4c-ab05-491d-9f37-ccf10207172c", "value": "11efe8447ae3f5354583e730cc5c17c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368298, "uuid": "230df7ad-a885-45cf-a441-b33509b4d500", "value": "384:OJvEmCcL2iPA9bOSQ0iYN4D8gxuLIsBjYli:UvaBBiTxuja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368298, "uuid": "820a2609-d03b-4b1d-b70e-87feac3879a8", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368298, "uuid": "daf20fc8-254f-4a58-a776-d2f773b28ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368298, "uuid": "74bdfc6e-34b6-4d5c-8c60-7d2a084e3805", "value": "c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a6b948-94ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786361021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361021, "uuid": "d2d783d9-c0f6-4b91-ba79-ab6b82057d3c", "comment": "Malware payload (ValleyRAT)", "value": "877cd0499f6dc0c6d03209bcdcd85fb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361021, "uuid": "0626d52f-590e-4dfa-a579-843a3d9bd90a", "comment": "Malware payload (ValleyRAT)", "value": "c6b5ecfa0866686c6dbc15c3686ee59f28f92d97d461240841eb7c05ac9a5ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361021, "uuid": "13ce0203-bf01-4898-a356-f4ab4455e8b0", "comment": "Malware payload (ValleyRAT)", "value": "deba9e3ba9bf004e0a055ff4144b013b4afeba6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361021, "uuid": "85c26c6e-35fa-4c01-b35a-4e9eb3bd2372", "comment": "Malware payload (ValleyRAT)", "value": "429490151d5199e4765cbdaaedb0f897b4846ecd238384d666da1e2d71f952ef31f2d20b12dac8b0311cbc27442243dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361021, "uuid": "193943dc-4a59-400c-a89d-3aa5b5430e7e", "value": "T1EE068C87B6F61354D9B7C138C6A7616AEA717C428F60A9CF125CB3191A736F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361021, "uuid": "8d897afe-53b4-4a02-ace9-6e8b0a78cb41", "value": "1d6756920139c62afca29cb579fd4954", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361021, "uuid": "5d50fd79-47c3-4c24-83cb-4c5df6af7e1f", "value": "49152:QDAn2xCeeraP8k9CVrggiL8PhzhJsv6tWKFdu9CcPTvG72MqOqRsjfJXcRWYNoiR:zDC9dQHJsv6tWKFdu9Cci4WQfPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786361021, "uuid": "a7571424-978a-46e0-b4d7-33589dcf6f29", "value": 3693056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786361021, "uuid": "89fd22c4-a87a-40ca-ae31-318f6b147bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361021, "uuid": "843b7a3b-1b45-4590-b29c-5c439bb48b3f", "value": "2026.08.10\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848_SUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f16f70d-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372856, "uuid": "81e763ac-c2f0-4061-8276-8945cc2d68e1", "comment": "Malware payload", "value": "2185a8e2f4b44deddef9fe6c3c878c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372856, "uuid": "e1fc5d6c-f7e8-48c0-a407-205fbd52aff9", "comment": "Malware payload", "value": "c6e02d8cb4cf05c7506705db675b71486fe468023406ebbcccc4529a3a02fc6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372856, "uuid": "4a95b727-6985-47d8-88a1-712ea37a0531", "comment": "Malware payload", "value": "9af329d04c6df6388ba116b084aad4d49cf74c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372856, "uuid": "57781479-72c4-4968-aa5a-56b9751095a0", "comment": "Malware payload", "value": "c0aece0ab8cb3299e9f72b5d9b199cf4c6c5d5eeb0d233372bf1005387611f986a6f02e1dcc050b83d0319d192ff5b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372856, "uuid": "1c64e5cd-19e1-4f3c-89e8-818a6d734172", "value": "T110647C25F6A914F9EA67C17CC9520901EA727C564771EBCF03A04AA73F236E06E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372856, "uuid": "4652800d-1d9e-49f3-86dd-9dafa3c2f98a", "value": "4b995419e7927c814e63fb6b90433d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372856, "uuid": "01afb278-cb61-4f16-984d-9d8a5c55baa7", "value": "6144:AhftNRR5IptSohQtXjyBCISVvsWlveXPl/4/:AFnj5IptSmQZanwkWy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372856, "uuid": "995cd258-020e-4e14-959c-be346543b795", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372856, "uuid": "6b6a2677-ec02-452c-a220-4ac83ff7d514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372856, "uuid": "30ddcb0e-8066-40b7-bb36-1d15552571ae", "value": "c6e02d8cb4cf05c7506705db675b71486fe468023406ebbcccc4529a3a02fc6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e54d080-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786370654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370654, "uuid": "21acc185-78ed-4af4-be7a-55c28a368eec", "comment": "Malware payload (AsyncRAT)", "value": "e6948aa43cfb86c862b937312150204f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370654, "uuid": "708449eb-9b5f-4d83-bdc1-276468da60a7", "comment": "Malware payload (AsyncRAT)", "value": "c6f1fe93e7b7018d9ef446ef2d75d387364355ae2a8919cc24e2e5c3c8696d9d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370654, "uuid": "fd9aa6d1-d121-4e0c-8735-53efdd928e9a", "comment": "Malware payload (AsyncRAT)", "value": "2f63dc179ed5be3d21720abc1b97a6879f738d14", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370654, "uuid": "ea153886-4d76-4451-95a2-94c9c20476a6", "comment": "Malware payload (AsyncRAT)", "value": "2e723b904e6cba55eb808cba26a9cb91c44e90353d6f98d269a9a941c26876785b3e0fda4f6a61935be0974039f81967", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370654, "uuid": "f6bbe886-86dd-4176-a07e-17eaf024d22d", "value": "T1990512185B88CD11E4E6473A9070F3B503F2BE8DA921C35A8FECAED73D26B05AD14761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370654, "uuid": "f6e112dc-66a8-43d3-ab2c-3fb2c303f761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370654, "uuid": "3f96a90c-e7bd-4cb7-9332-807778f6541a", "value": "24576:y9T+3hApneuKetD+gw58CniRDbrKSeqO:iC3hAprtDBwERDjnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370654, "uuid": "29ac68db-0bc1-4596-b222-bd16573d5f36", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370654, "uuid": "0fefed4f-e40a-4432-bdd5-cf76eda9c485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370654, "uuid": "af2371ea-4191-4180-9b0a-1f706057135a", "value": "c6f1fe93e7b7018d9ef446ef2d75d387364355ae2a8919cc24e2e5c3c8696d9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7b5d8b-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786369520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369520, "uuid": "df9f39c7-00f9-4fd1-9f9a-65323e461ac0", "comment": "Malware payload (AsyncRAT)", "value": "455ec8e5c30960eae30519e3f105b3a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369520, "uuid": "0bcf2de8-a127-4349-99a3-7adca4e7bd53", "comment": "Malware payload (AsyncRAT)", "value": "c70590718cf730218865545de29bf21f4cc4c450850fca0f3d14b9c219b0424b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369520, "uuid": "1e38ba9f-abcc-498a-92fa-e362268c72bb", "comment": "Malware payload (AsyncRAT)", "value": "d32199b19e8aea415ee261aab5db818224cbdca9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369520, "uuid": "d0231f48-3020-4db7-8d58-d579faad031c", "comment": "Malware payload (AsyncRAT)", "value": "5c0a27d5651d4dca4154a181a4769973b1b24a0166b7e105772004050d1099a8feaaa8e2ebdfc5344f1450544fb50b5b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369520, "uuid": "0e55cc3e-0e5f-4542-9068-ffa34237e87e", "value": "T17F050258674DC806D9255B386CB0E2BC16A93E59FA10D3179FECBEDF39726118C85382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369520, "uuid": "581737d0-c5aa-4f7b-9cd9-6cff8d6c0710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369520, "uuid": "057896a7-9b8d-4b5e-95df-d553f31bd500", "value": "24576:v9jvV0LDQHL747Og/hfzMD7R5/3H4FK8S82F5CazplP:v9jN0LU7MOgJfg//H/832F5N9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369520, "uuid": "7c020580-dbf4-440e-91b4-c952d3531de8", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369520, "uuid": "6d434799-e4b5-403d-8869-eaefbd6db843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369520, "uuid": "5b823dbf-c4a5-40b0-b0c2-b663277ed484", "value": "c70590718cf730218865545de29bf21f4cc4c450850fca0f3d14b9c219b0424b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331b707a-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "41ca3de6-cd67-48bf-8c30-34929ebda4d5", "comment": "Malware payload (Mirai)", "value": "f031d1610fd5baf45ee4a3802a962d4d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "acccf1b6-2680-4b75-84a4-321b9586fab7", "comment": "Malware payload (Mirai)", "value": "c71ae06f417ef28c835c82bd03245e93aa7432fc7cbd650f80074421e7ac9035", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "71904f47-b22d-4d0f-81f6-de1740623a6b", "comment": "Malware payload (Mirai)", "value": "d96155bee185b67eec36d449532632baff4e5836", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "c5a48fa5-bcbc-4872-955b-3ce544479e22", "comment": "Malware payload (Mirai)", "value": "1743ed3a4125c5f37f0091a4ea56fdb1031eab6f18cf009646817534e27eb2cdbed12af7d4299216131bbbb25e64300f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "a0df5676-b538-4917-b97e-ec92b9d95b71", "value": "T176142A45FC419B12C6C716BBFBAE428D372917B8D3EE31039D215F25378A49B0E3A646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "0d742c78-0dab-4356-8742-53972ae30b4e", "value": "3072:Hs2a3QAoFZVulWHKYBAgOyAuUByu7C2GVn7qjxBoxmnmyg1Ihs:HsF7opn2lyAupYC2GGImnieh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356837, "uuid": "dbc1f21f-1533-444e-899b-8575b2a45c44", "value": 192472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356837, "uuid": "fa2d40ba-2e95-4ead-831f-74757b826632", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "225c4c4d-f392-4f9c-a847-9c843da08837", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8427ffd2-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373294, "uuid": "1b52bf87-6aeb-4ee6-93ae-a3e6203c9d8e", "comment": "Malware payload", "value": "a9085f002d8563693cd764c5326ed626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373294, "uuid": "65368f70-84d9-4793-b4cb-355ea3eb2537", "comment": "Malware payload", "value": "c71ded581b5d2cb8fb29fdfefd8e361a1c9067f4d901aac65ce2c00ebea3d297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373294, "uuid": "296ad06b-69ec-4949-bd49-ad30fe89f0e5", "comment": "Malware payload", "value": "f591d89293ec3bb279593c4d42f599dcb7e85d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373294, "uuid": "2373b8f1-334b-4676-89f3-f866440daea4", "comment": "Malware payload", "value": "9c7664a84adcc11a235e88fc078e7ff5f0459a6089f691c30e0de8b08a58345f0761cebfb655a4b6315d2ed9d5b9f4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373294, "uuid": "48d6d92e-292d-4e2a-9422-41a835679d14", "value": "T1EA3512311C872B69CF3C0FB8C162085427F0DA1A83A2E75A2EFD12B65ED36C59D27695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373294, "uuid": "23d79814-f906-4cb4-b168-9ea966bd203f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373294, "uuid": "d9dbd959-9594-4b20-88c1-b2edcd01b872", "value": "24576:g/zdX2YaVWgYfTfn/oTgPQHo0+4lW+/IPBiSXy9IEVWbOxt:gJ2YaLoTYgoI09lWxPBivoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373294, "uuid": "616f3cb5-996a-431c-bb33-9ae97f4eca01", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373294, "uuid": "535a9a45-eb6f-47bc-8d71-86e297aa2d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373294, "uuid": "a42bd5ca-d82d-494b-9faf-a207c2c8dd75", "value": "c71ded581b5d2cb8fb29fdfefd8e361a1c9067f4d901aac65ce2c00ebea3d297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25894c4-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786369506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369506, "uuid": "161df3ed-061b-4f4a-a0fa-1e8d03db8436", "comment": "Malware payload (AsyncRAT)", "value": "689d21259debd251d18f29e755ed5047", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369506, "uuid": "4178d533-29b8-4547-972f-74df0dee9c82", "comment": "Malware payload (AsyncRAT)", "value": "c72a16f9d18a75f9ccc80bb1a3550e147c19a079700b1a7bfc752907656b06cf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369506, "uuid": "dcd76c66-4fa4-4960-8a69-247a90b24f56", "comment": "Malware payload (AsyncRAT)", "value": "0336278df771a71cac31a51b05aa4f3185cb9394", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369506, "uuid": "73c5c779-be0d-4850-8966-cbbd3522c141", "comment": "Malware payload (AsyncRAT)", "value": "46b2896dd07063346f0b4d620fc1163d8259cb26fe50ce1be1c4ad37da9f34f614c5bf16ec618a6ae4b4c47f67be0e05", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369506, "uuid": "5b15edd8-12e7-497a-97d0-a58caf835e12", "value": "T19B15F14867A8CD06C46A1774A8B4D2380B795E59FA12E3035FD8BEFB7D777228C14287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369506, "uuid": "629e8f47-e035-4400-8849-43871b9551da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369506, "uuid": "0e6f88ab-42b9-45a6-819a-bd6d155f69c0", "value": "24576:iAU16OOVoz/NYN7VDJT0pcaM5KxPEJBvV0L:iASM0/NaLT0pi5WcJBN0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369506, "uuid": "8ab600fe-75d1-45e6-9aea-85544d5ac093", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369506, "uuid": "105d47e0-c789-49db-997a-6d09784d1003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369506, "uuid": "fde9683a-8589-4fc0-897e-b8ba4fda11c5", "value": "c72a16f9d18a75f9ccc80bb1a3550e147c19a079700b1a7bfc752907656b06cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6195c2b-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339931, "uuid": "483e10cf-5b10-493b-b426-a1af156a0e55", "comment": "Malware payload (Mirai)", "value": "23cc4cd96f3b815ca0e281e51b20c8c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339931, "uuid": "60aea6e1-2197-4d42-b254-4ddd232e52f6", "comment": "Malware payload (Mirai)", "value": "c75aba7214eb02ee97d83987f68651f9bdffec3f39e8b7a26834f450b3107bca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339931, "uuid": "c4c55c7d-5cd8-49ab-95d6-7e0762c255ee", "comment": "Malware payload (Mirai)", "value": "205a57a05acba8685b3f6c2a1f32c1b7e7f66dc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339931, "uuid": "d7dc5f76-3cf7-463d-84bf-73e2d43aa454", "comment": "Malware payload (Mirai)", "value": "69754d7923b14b209872a84983ae84cef542183ccf8d6e0961411550f3c5511828b2065a5b7d41db0ba2a295a6ecb7b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339931, "uuid": "e3c17232-a8c6-4cfe-a92f-f3cf6d462059", "value": "T125A42B89E2F1E7DFC009E6305672AD1159E3093338D3268A725DE67E27721990E9F9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339931, "uuid": "23951bc4-f6d3-4798-b32a-5a961674776f", "value": "6144:eXT3AnXuOegQjwDkCROiU3mDhwhxvMpt7O20xDG+5YBq4:eXT3A+zjEZowyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339931, "uuid": "72908e42-7dac-4430-87ab-4ef885e559bc", "value": 488084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339931, "uuid": "6f245485-3b81-4dd7-89d5-f8cf821b2ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339931, "uuid": "2717d366-ee97-4184-8735-f370368b9aec", "value": "vlxx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b7e9f9-9508-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786399895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399895, "uuid": "abff4c1e-c6f0-4f74-879a-566ba82a9799", "comment": "Malware payload", "value": "2ed6e3fc1ad03dfe9b4ee8cd0e0286eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399895, "uuid": "84544305-f978-457a-8626-8b8e80772952", "comment": "Malware payload", "value": "c77e845feedc323ea12c20ae1859ec06e5959b37d06225bf878f2d7f0e82e66e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399895, "uuid": "5d1a677f-95a8-43de-b1fc-7627431dfead", "comment": "Malware payload", "value": "b8f6ab80fe2dc5f92ba8b0a480c943260b4469ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399895, "uuid": "f874ac11-486c-4179-bd2e-5c51eba8f07c", "comment": "Malware payload", "value": "61380177bd3368e68036062f1a624bda0b69a3a59f828833766dd1bb8d612864509a51aca6af221c9266a9548a7e7833", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399895, "uuid": "159bc61a-53e3-45df-833b-ff98e829b9fb", "value": "T16F9633A3510619B59483F944E3287CC187A5381B8BE9B8328F4BCAE64DB59F3D7C6707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399895, "uuid": "affb9616-550a-4858-b691-3b96feeb7d47", "value": "196608:V7RMKKwkni/LzitFnQHklcWgtbuoInjakCNZBY031idBQ8NX/4Q:V7RYwAnpc0o8WkCNZBY031idB5QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786399895, "uuid": "c96a6669-a071-4cea-8020-d1af7a89fde0", "value": 8790076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786399895, "uuid": "f9268759-8b4c-4fad-a765-da3fcc93cc36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399895, "uuid": "87d1cd49-4b76-46af-a791-241413be1b41", "value": "gg11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af88162e-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372078, "uuid": "a4d85384-3040-4def-83bf-b0e2c5f4ec98", "comment": "Malware payload (Formbook)", "value": "b3fdf47f7747a1aa8f6a1698cb899cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372078, "uuid": "5b1171c0-55c1-4ccc-af95-8499cd5c7203", "comment": "Malware payload (Formbook)", "value": "c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372078, "uuid": "bfd70198-86bb-43c3-a91c-54dd957005e5", "comment": "Malware payload (Formbook)", "value": "bec514381f775b00f1012d496ab0cd9abde9ec37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372078, "uuid": "21b7d3c3-2f02-4816-9daa-3c304c9ed088", "comment": "Malware payload (Formbook)", "value": "9c80b979ba2d18b72862eec2bb7585ce18d1a6d40eff033993754c1e91f94218a1674cb7b72775f8a6ba17ba8f03507e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372078, "uuid": "e4bd5c67-2977-4204-8bba-6d96b35f3700", "value": "T11A3523A08399C522C4A9577644A6D3B12376DF9EF332E76E8FCCFCABB6217102405785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372078, "uuid": "c6f0b577-e594-47b7-88b4-a1a9405656c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372078, "uuid": "3e9b4e7f-6b8e-47af-8766-2ac12b4f3543", "value": "24576:wW+G19tHIdV8b8XgC0m8ftzdYl/kF0RXND6bH:vxhIdV8b8Xn0m8ftal8F0RX8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372078, "uuid": "8f24b2f1-f77d-4715-81a4-97e75147c685", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372078, "uuid": "2b68e13f-61b5-4a48-b865-449d186e6b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372078, "uuid": "d0ce67cd-3d22-41f0-a03e-e8a210f6e192", "value": "c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a6de7b-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347196, "uuid": "2ffdaa2a-0303-421e-a373-b0219431bde1", "comment": "Malware payload (Mirai)", "value": "a0982a423b66b006efb91a514c6739d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347196, "uuid": "47d8afa3-3537-4c87-a0d3-45f3c7159ead", "comment": "Malware payload (Mirai)", "value": "c7f9cdd6d85285ab85056ce7a49fa087b5f56dab68beae6a3ebb0d6c538080b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347196, "uuid": "d7d6ec14-f0dc-49c0-aae2-59cb2b9e7e83", "comment": "Malware payload (Mirai)", "value": "11f516d81ad56e40f04072ee7183a8441229ffca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347196, "uuid": "93c02b66-8335-4d0d-8ace-c25d8224012d", "comment": "Malware payload (Mirai)", "value": "99ae817c17b445cf77132dae4af9a6a5195966c0fe1273e36aa2c40c99f9474a4ba762406df4379c4694c801ae8b78f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347196, "uuid": "4257ecf2-0730-45a4-8e8e-85626100b372", "value": "T157156B42FB1C4532C9470EF1197F43D5F7217A4241F5A22A770FAB672622E3A9AC734A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347196, "uuid": "71c54d8e-e360-4f6a-8ace-fccae49cea57", "value": "24576:gvtLVHKQ+RfN8ePG4LVfo50cEJ5USus8HndrZP/RcTVs:gvtJKQ+RfN8ePTf1cE4Sx8HnpZPUVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347196, "uuid": "91d65bb4-7eb4-431e-8d1b-4a3940e0e55d", "value": 930604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347196, "uuid": "0f437813-7aeb-4d0f-a688-b87ea46fa355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347196, "uuid": "66c6a8e1-81d2-4e42-ac6a-f0df59e0f543", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920ba47e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374176, "uuid": "39256bc7-a9f7-40b5-8fef-865ce0a2d9cf", "comment": "Malware payload (AsyncRAT)", "value": "aaecbb9c3fa5a191ffcc85633fcaf2d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374176, "uuid": "736f1265-637d-44df-8aa3-f79739c06d1d", "comment": "Malware payload (AsyncRAT)", "value": "c803ce174f0688c83f94db7001b99d103b5d027be7d0d230494a5dfdb88c9619", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374176, "uuid": "04155258-1dd4-44ee-801d-39a1cb2c73c6", "comment": "Malware payload (AsyncRAT)", "value": "8b50f21d705a8314c86391b651cc1ecf5260072a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374176, "uuid": "d69107e3-3127-44bd-9ccc-4a83c037f923", "comment": "Malware payload (AsyncRAT)", "value": "126d0238ee676082d6e51d424130ad0d178d3cbe8a70927e83631f72174e85211bced43fb1b9edb48c1ade9eab93634a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374176, "uuid": "f5393d29-4f4d-4e80-910c-dd54c844b630", "value": "T1FD0512986A0AD913CD4413385EB2F7B953BC4EEDA901D3176FDDBEEB7936A114D00282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374176, "uuid": "17e30fb0-9937-4a5a-b5c5-8ebbc8d2c19f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374176, "uuid": "8f757ef8-8d9a-4569-a340-93d049bbd1fa", "value": "12288:F2WDOhiqIkFQbl4WhQTuqp2Xo84N+1edh8SvjlDIFK2cRKeR2d/9B6:oWqhGkybl40XobDZjlEFveA9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374176, "uuid": "177e57e0-0121-426d-b12c-1ea4184084ff", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374176, "uuid": "a808ad73-f16a-4025-9bb5-ab52ce0756c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374176, "uuid": "8f684ef8-742c-4b50-a9b4-5a53603659f9", "value": "c803ce174f0688c83f94db7001b99d103b5d027be7d0d230494a5dfdb88c9619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de126cd0-9494-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786350252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350252, "uuid": "50641077-0361-44ca-8fa3-f114802a1c30", "comment": "Malware payload (PureLogsStealer)", "value": "0bc755a061e932971b5e642b99adda04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350252, "uuid": "e36c6f11-a86a-40f4-aa8f-1c498aa53c9d", "comment": "Malware payload (PureLogsStealer)", "value": "c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350252, "uuid": "ad1c5851-98a8-43e6-a433-8ed228155db5", "comment": "Malware payload (PureLogsStealer)", "value": "40bb4c848b9e8843d48884ded074af0dc183778d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350252, "uuid": "2b014edb-cda2-455e-a446-5f9a6f80d4ec", "comment": "Malware payload (PureLogsStealer)", "value": "d6190cd24383f518bb37241d6789b08853ee6f25595f5c30035cd0a353607353447511b26310493011b8a9ae9ef1892d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350252, "uuid": "d2fab1f0-98f7-4513-a5fa-c68ad21f08f4", "value": "T113751240239AEE14D0A30FF40A70D7B513B46D49B921D20B9EEA7DEF783A78468593D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350252, "uuid": "610242b0-70ca-4838-a4ac-e6c14dfce8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350252, "uuid": "dc7c6edf-81cf-4bcd-8c8b-8e4cc7ea1dbb", "value": "24576:9ejpQLCVBx27MlptJHE1Sl5vkgRlaBte5LwynG59YGmQEx8bZ2e1V7HNUA5Vg:qSOVBo7MrrHEQ4JIr4z7EKZ/LNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350252, "uuid": "eab1fb3d-66e5-4fc5-938e-c159d54be373", "value": 1683456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350252, "uuid": "308b6056-99fb-40cc-a6f0-3b86f403a2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350252, "uuid": "be96f010-34d2-4ac4-83a2-03d84b4ecbbd", "value": "Pembayaran dikirimkan 07082026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337c05f7-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786372729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372729, "uuid": "91a01903-5319-4138-af7b-0541bfda31f9", "comment": "Malware payload (DarkCloud)", "value": "2ebc34b986759bae3761df3315a8010b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372729, "uuid": "845a4d08-ce73-45f9-9208-31642ebab552", "comment": "Malware payload (DarkCloud)", "value": "c884689a54186d2576df44b4ea2c2dee3d8da331c40b50b71ec2104c408df995", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372729, "uuid": "7a1151c1-3a37-421f-afa3-03aa6d917597", "comment": "Malware payload (DarkCloud)", "value": "0b90cef65d4ec367d7e86c6a3a136d5a6e260b0a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372729, "uuid": "e0ca1fd1-b30d-4205-bcc0-7d5560b7fcd3", "comment": "Malware payload (DarkCloud)", "value": "6d59bf22de32cf411764480b7ababa76e1814acf0242b1659a8d78d8f1936e9aad537a71a3ae9aab2c626ed97e77069a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372729, "uuid": "d421488b-cef9-46cb-9875-13f3ef72aa13", "value": "T1665501141327E852D1D697B3B8E0D37433B50ECF79D2C2965FEA2FA7791A3C29990281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372729, "uuid": "a038267c-4b10-45c5-8dde-0ebd722202e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372729, "uuid": "8d8b2790-ce46-4155-a9a8-036f6b4e51de", "value": "24576:Ybp50ceux8kDXhCqcBUdUkmCxDtAtj6YtQOEh049D02kMuxJ9SCJmMuAgzeD0+SM:OpCuO2YSGCBttYtQOvkLI7sFAgz7mgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372729, "uuid": "0412320b-2e3f-4475-94c2-083f0acd333f", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372729, "uuid": "ce55c3d5-c56c-4073-ac39-fed7cfe56cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372729, "uuid": "0b90fb65-760c-4f25-b667-4508be7b7427", "value": "c884689a54186d2576df44b4ea2c2dee3d8da331c40b50b71ec2104c408df995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce35bcd0-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340347, "uuid": "30639185-5c9f-48bd-9f44-8595f2ac049c", "comment": "Malware payload (Mirai)", "value": "0a78dbd2113b00c7ddee743d5f9d6f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340347, "uuid": "30dfc5f2-13c5-42a4-95a8-b5ac90e718b8", "comment": "Malware payload (Mirai)", "value": "c8863ddb05854ee85d592c091daabd488c945ec430975d41b6a09dce35ddfa34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340347, "uuid": "29c3cf65-fbe0-4358-848e-1c5277f39c5d", "comment": "Malware payload (Mirai)", "value": "ad6e2fd466d19be3537ed5502bc001e268b0b86b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340347, "uuid": "28828055-f884-494b-805b-751c481c06e9", "comment": "Malware payload (Mirai)", "value": "1c3096ac6945aaed1b964f8977f37557479b27143b3ad3259c2fa1dd5a6a49de02da4cda536549f34ed57b0e3a971db4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340347, "uuid": "18aeb94a-51de-408e-98a9-25e4cc5af594", "value": "T195A42B847AA0FBCFC16CDF70936EFD1718A141A270D3315AB16DD7EB23762450A9B8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340347, "uuid": "ffce3bef-d3e6-4856-b86b-6c67148e5725", "value": "6144:sXTAa99U7YITyhJjxd8md5hJHBIXTEXY9uV6mMVpyVYwi6HmdWjUCF:sXTAa967DyjjbhWTyNSwi8mdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340347, "uuid": "222882df-7ae2-41cb-a6d4-426549996f1d", "value": 488580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340347, "uuid": "4ea909ed-5eb5-4965-820e-acafd4f28ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340347, "uuid": "60b3b5c4-7ed9-446d-a7c9-10708849b153", "value": "vlxx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764fc314-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340200, "uuid": "9a154c16-b005-452a-a7d4-535ff3cb81dd", "comment": "Malware payload (Mirai)", "value": "36b2f79483a46746ab5eea4839728bbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340200, "uuid": "657d0d76-8ee0-4779-8d07-b83f54822867", "comment": "Malware payload (Mirai)", "value": "c88cfd7eb3f0c3e246bca13f356da55499e22d548223a9d64495ee4f64f3ae96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340200, "uuid": "99f99688-869b-46c7-a2ad-5ca1a11b227f", "comment": "Malware payload (Mirai)", "value": "a007c2dd99f5c92409080ce59b97347ff6b24525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340200, "uuid": "61036767-35fe-4770-b876-32aefd4253e3", "comment": "Malware payload (Mirai)", "value": "35e7bbf93c524ef1ff452cc732f29084deb26aa653990bb255fbe5efaec3de9679256d30bee20e2d2940015cc93da6a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340200, "uuid": "ef51d44e-e562-4f5c-b965-4099b58414c3", "value": "T17A746D8862F5F3DEE2C8F97953057C165872293A30A3B295310FA67753A72540AFEE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340200, "uuid": "6265dba1-5ae1-47d8-8b5a-91c52890268c", "value": "6144:ca9ea95a9g1qD6LYepAdyW9xaqNhj79dE695C+Z40:ca9ea95a9g1ESpK9xPNhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340200, "uuid": "6e3a92a8-420e-4b73-93ef-c93e62190b06", "value": 370712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340200, "uuid": "551a04c2-0fb7-442b-9a46-902ce7ff1499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340200, "uuid": "c6d93c41-223b-4eb4-8adf-9be4be80edce", "value": "pid.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc1b6bf-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330065, "uuid": "55980f41-8aa8-4b81-af9b-4c02a77bb4c0", "comment": "Malware payload", "value": "16c66e16607eca1f5ae334a265f0af09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330065, "uuid": "242ff37c-b640-4cb6-b93e-19ef99b22a24", "comment": "Malware payload", "value": "c90ef79cc765f2728dc3a8054a35c27eb65ccbaf82f36988d7b4325278712130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330065, "uuid": "704369ae-3b8c-4ea0-ae50-0a26592b4d79", "comment": "Malware payload", "value": "38d687f5cf4d1af785b13cc4d6ed228581ac969e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330065, "uuid": "c0b99feb-8b1a-45c5-9d71-fe5c1ae610b7", "comment": "Malware payload", "value": "35eded0da6c621113c9cc4eb25b1a76a7474ae46beb9f0834e580043e0a78ca9a1d7dcb076cb2b0341cb1d8148052e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330065, "uuid": "7878f989-df81-4eb3-9c53-f45002741344", "value": "T19B2309D4F844DA35CBD075FAF51E83DD33030FA8E6EA71119E2266312BB79094A3B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330065, "uuid": "349e617b-3f3c-46ee-b52a-8d2e430dd050", "value": "768:i7vgvTpY4shZzvY7t1KgY4bVcPJkz3k1DF/9wwZA3Vf7r4ujWL6tL6vj9g:i7YvTpM3zvY7t0gYC6RkrkH/9v0rzjWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330065, "uuid": "a08edf96-cfad-4c68-ae79-77349008da10", "value": 45960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330065, "uuid": "c1ca3a31-6105-4f01-ab16-8d88a422e9c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330065, "uuid": "717c30d6-2e32-4337-b46c-c41074b4bafa", "value": "main.armebv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d84b284-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371189, "uuid": "a59bec1f-fd10-4306-b9b9-45cf01577311", "comment": "Malware payload (Formbook)", "value": "3535ef4bb2fbdfd423f1834af183ed22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371189, "uuid": "3f0aa991-c66e-4e49-b680-e8b5d69b543c", "comment": "Malware payload (Formbook)", "value": "c92476dc891f9345d354d2d53c8d53bca8fea74f8d27df9a4a32b4c550f1fa7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371189, "uuid": "94db450f-2d6a-4716-82cb-464bd40278e0", "comment": "Malware payload (Formbook)", "value": "62a6f685bbe7dd985219c69319e3df789b068457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371189, "uuid": "b8d3c20f-2dff-4772-b6ce-9522287127f6", "comment": "Malware payload (Formbook)", "value": "47c1ddfa5b697d687a0cec2ad778d41abdada19d2fc19c50a535488793cc1df78bb4820847184c8ae40ff6b44ec27ce6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371189, "uuid": "8819d2fb-773c-4bb9-b838-e6f9b4efde1f", "value": "T1C83512492216CD02C9D21FB51E70E3B046B84E99A815EB13CFFABDEFB87E6C52D45190", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371189, "uuid": "ecf840da-2692-4fdf-affb-182f2d66c074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371189, "uuid": "99249cf0-29da-43f8-a5e2-eb906177de2a", "value": "24576:qP4EvohUYIMnMmMzo7+SlJMZ5/EgiC24yoNTdJ4R6pF:QopMo75l2LES20TdGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371189, "uuid": "087c306b-0cd3-449a-931f-f996cacc4956", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371189, "uuid": "f0bf4d14-8462-495d-957a-6327ef8e8efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371189, "uuid": "5d61fcac-04f2-4e51-8095-4b39796f55f9", "value": "c92476dc891f9345d354d2d53c8d53bca8fea74f8d27df9a4a32b4c550f1fa7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7b3b25-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786370629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370629, "uuid": "58e59a30-c63f-44a5-aa60-e72b39a6a09d", "comment": "Malware payload (RemcosRAT)", "value": "d55a52a7b51f7cc1ad1980f543bc1dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370629, "uuid": "c4467999-0ed4-467e-9fe1-29f602974b93", "comment": "Malware payload (RemcosRAT)", "value": "c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370629, "uuid": "bfd42bbd-b703-455f-883d-882227be46a3", "comment": "Malware payload (RemcosRAT)", "value": "56cb902024fcb77c61688fef112de3da3dfe6ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370629, "uuid": "76ab6650-9829-41fd-94ef-309c7904ed49", "comment": "Malware payload (RemcosRAT)", "value": "a5d5d4a2d4db48a357e77632df7ea97a8f29ca6b7238d5d7700be9792c1aafd9779ba9fa95514107aca100b32018969a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370629, "uuid": "518aaf4b-4850-4858-a6cf-52e4d10c8448", "value": "T1390512A0560ADE03E4960BB508B1F37A52B09D9DE500D71BDAFDDEDB7C1DA093D18AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370629, "uuid": "af14bcfc-469a-4673-95fd-84df962817ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370629, "uuid": "ee4061c1-5e50-4587-80a8-170b48e00f6f", "value": "24576:v3IgyCnoEiKa928H+BNuBXkyUQr6wRD4UbYl:v4CnoH9QyVhUQ+WD4U8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370629, "uuid": "9dabaf0e-a783-430c-880b-d9c4ce3e8fbb", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370629, "uuid": "8024b901-7ad4-4080-bc69-f37cdefcc298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370629, "uuid": "c40b6d7f-aaf9-4b76-8546-c014658d5253", "value": "c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28119b19-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372710, "uuid": "71c3bc05-ec14-4ab4-92c5-2c12106bcd70", "comment": "Malware payload (Vidar)", "value": "ba06706fa68b4bcb2e7ce38e1bcc86c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372710, "uuid": "ed230fce-2673-4457-be00-33734fedc141", "comment": "Malware payload (Vidar)", "value": "c99659bf7a34b32f0363abf38eab92b341dcb60eb7cddd0f02ccced2b3f90fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372710, "uuid": "77141afa-019e-4951-946f-99066876669e", "comment": "Malware payload (Vidar)", "value": "258837a1ae6b0c89d693d1f231ae6ae46f9a4748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372710, "uuid": "2b50bdbd-09a0-4fd4-81f6-c78df68bc73f", "comment": "Malware payload (Vidar)", "value": "0d99800cae218b71d8c81c5b2c014e393e041b6a0ebf156ea90c202960117debca4f9fbfc5d155542f0d69c2bc2aae94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372710, "uuid": "e971830c-7329-41bf-a3cc-a7ee77129a4b", "value": "T1FEF57B0B7CE04AF5D0AD923189B66592B765BC490B3133E72E407B782F727C0AD7AB45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372710, "uuid": "17f97aa7-d599-4022-a33d-471a7c7156c9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372710, "uuid": "61d61417-b54e-4960-bdc4-7335843fc9b1", "value": "49152:xMvKBpGSQwV+iSStaHEDkG/YrXCe8scR+eQO1qYGSp263jKYONF:xMyV2B30p26bO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372710, "uuid": "59770ee7-7bf6-4f05-b18d-afdc1ac1aab7", "value": 3388264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372710, "uuid": "633c7084-3db6-47c5-b671-f5d42b28790e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372710, "uuid": "36d5267b-b6b7-457a-aa8d-b0df57a60d05", "value": "c99659bf7a34b32f0363abf38eab92b341dcb60eb7cddd0f02ccced2b3f90fc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6480dcf-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373351, "uuid": "3dbda495-8069-4838-a120-958b95e07425", "comment": "Malware payload (Formbook)", "value": "51424fe3f32b10c678c4838fbc2e533c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373351, "uuid": "24abc6a6-f9f6-4baf-8b12-5caa1c922aae", "comment": "Malware payload (Formbook)", "value": "c9c875dea57d0a648e55b0b178bf5aa37465bca4c5d00f5b21ba1069e28a30ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373351, "uuid": "0d60cf5c-eebb-4ec3-b017-a4f4a8c66308", "comment": "Malware payload (Formbook)", "value": "3fd0bbcb15b54c6c3e4f88ca56e87453cdd235b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373351, "uuid": "061c4859-a89c-4409-a91f-5e8b85965e4c", "comment": "Malware payload (Formbook)", "value": "293916a5d1bccbc537724a7751e87549952dcf1abfa80010d22a5a2125be3b6e9b89957b49843f8316e0e19d5f7013a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373351, "uuid": "c4ab2291-c100-4446-89d9-fa4beda17cf9", "value": "T1FD5422416682B35AE69683B81C6C95E60F24967CC187A63F761F1E38EA330FFDD40D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373351, "uuid": "a065c4d7-c682-49d1-ac2b-d9eebc2c5856", "value": "6144:b9IkgcOG9rhOm7ZCaMOjaeurlTBxIXwfkntR1v+hSKST400hE6wh:bekgcOGrhOGC3Ojyr1AAMnr1qSzCG6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373351, "uuid": "1d006f55-5379-4df8-a347-29f3e6421238", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373351, "uuid": "b98f11d0-8225-4c09-b937-dd4a05b0c4d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373351, "uuid": "6c364833-ec91-462f-a3c2-ed060735e1d1", "value": "c9c875dea57d0a648e55b0b178bf5aa37465bca4c5d00f5b21ba1069e28a30ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98808332-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372040, "uuid": "d2b4d73d-d217-4423-8795-f7ae6aa7acc4", "comment": "Malware payload (AgentTesla)", "value": "17e0d030e8a1730bde40df788d898d4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372040, "uuid": "5724daab-5fc5-4461-8824-747a63d14360", "comment": "Malware payload (AgentTesla)", "value": "c9cd4a2516b460833191ea12676acaeeef27c5ad96bd55efaef812a1991401de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372040, "uuid": "98d42e43-c713-46d0-8dd8-66b56a2fa766", "comment": "Malware payload (AgentTesla)", "value": "35a4848fb054249fcc67b66ca0d280310be60a6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372040, "uuid": "2e0aeec0-c7dc-4751-8f2e-b0e52dc01084", "comment": "Malware payload (AgentTesla)", "value": "13f8654302d8d8f468c0c7ecedfb0beebb1155c38cccdd76bebf154065955018bc0afcf383d247e0840249530f375f24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372040, "uuid": "45609cde-2d5d-4672-95cd-2f12031e7c8b", "value": "T1B14522983B5EDF1BC2910BB84DB2E33553749D19E821D30BEBD17EDBB934B4118806A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372040, "uuid": "5551b8e8-c3ca-4d37-8a5c-557681ad0b23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372040, "uuid": "cd2eb389-8565-4d7b-b05b-4b1443c6f792", "value": "24576:dj/Og32gNSFKKnaEKfiZzL4Qcg9IqHZYNU5C2yq:dPGgNSdZNcgdZvQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372040, "uuid": "bab4231a-9546-4363-b9fd-3ae013680775", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372040, "uuid": "403aec77-1847-45d9-9671-8b1c8b554e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372040, "uuid": "d63cb731-a1df-425c-b8bf-c98d123a90e4", "value": "c9cd4a2516b460833191ea12676acaeeef27c5ad96bd55efaef812a1991401de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8256c30e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383599, "uuid": "8837fb8a-b401-4af8-9de1-69b189cc8c26", "comment": "Malware payload (Mirai)", "value": "506930ffe324dec268adef6739dcfa97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383599, "uuid": "35cdeb84-f9ea-4430-b59f-ec1b65a9bbac", "comment": "Malware payload (Mirai)", "value": "c9d96288fe6a7e458d079e4d13031d4f01415054d75dec3de07201b932b1dd3d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383599, "uuid": "4036f9fa-73f5-419b-ac22-a05b40a4712e", "comment": "Malware payload (Mirai)", "value": "9d65fc42a02cc0c969c2f5a04fc45c6d816103ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383599, "uuid": "062e1000-75ca-4247-a26b-23471cfa4714", "comment": "Malware payload (Mirai)", "value": "dfdf9804654659e189be1c41ffda0ae0a3d6f7f7f2c1ca1537994d8ef175b6af420c6f734d08362b9094b9574d2c3c40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383599, "uuid": "00c33051-c221-4e21-a086-ef08290a6f14", "value": "T1F3F36B82FA83E2F1E5971570001BA71F4B349C398224DE5AEBA42E31ECB6706565B77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383599, "uuid": "cd8ac16a-c057-4bb2-a714-b96e5e147eac", "value": "3072:jn2kfkLMA7rq7UDE3WaDq4nxfbYrjh7o/HYiB2DdDRtfLtahXT2/qp9:jn2Y4q4DUWae4nirlAAdDTSS/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383599, "uuid": "70cf5370-c15d-4668-9c6f-38f5d1d2eb32", "value": 161108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383599, "uuid": "ccbfd2c9-cdcd-4a58-b4fd-e551d64e5db0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383599, "uuid": "079d4bb2-3132-49eb-af1c-2f89a8e98349", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d66bdc2-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373122, "uuid": "37974800-78fc-45ad-9e28-a75838e1ebf3", "comment": "Malware payload (DarkCloud)", "value": "303ef6167c8a9842226acf4b1cf72754", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373122, "uuid": "61e0ed0e-4dad-4ff3-b143-9c596886891b", "comment": "Malware payload (DarkCloud)", "value": "c9dde95c0675425d3222564efafb7029931cb5a5ef7846c2e6d1ae00ba2d4b6f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373122, "uuid": "4d6ae9dc-5b57-403e-b60a-28509f05590e", "comment": "Malware payload (DarkCloud)", "value": "d001a3b3597bf8103b13fe4d468fea03b7cecfac", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373122, "uuid": "5965a897-e13b-40e5-b792-cb0eebdad24f", "comment": "Malware payload (DarkCloud)", "value": "c6d6e6cec948f0559d96547eedbf3bfd0c70d47be1072e1c7d606a378f0c5c5eeecd31c45503acb4d7c895e98b730043", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373122, "uuid": "4487a0e6-ab89-406d-81ff-6e3bf3e15f9a", "value": "T12F550100135BCC02E0E68BF6A8F1D27432B05ECFB9E6C29BAFD55FA739167C59590642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373122, "uuid": "04ca63cc-54eb-430e-8d83-33fda400257e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373122, "uuid": "ffb2e0a1-8e13-4401-8042-9edbb4069839", "value": "24576:3Gb/Dgm/D2Up50s+FI/bRugNQ2g7fyKssNXSIUx7gVmTeiQfvmnt2:+pt1ugNQ2YhiIUpHfQXWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373122, "uuid": "a94287e1-2c76-44d9-8646-9072e17a1dbc", "value": 1310208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373122, "uuid": "e90dfd2c-e43f-43b3-ab2c-f472acb11c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373122, "uuid": "6d3b6d64-a25e-4505-9e50-c2ced0dda8f0", "value": "c9dde95c0675425d3222564efafb7029931cb5a5ef7846c2e6d1ae00ba2d4b6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99505ad6-9491-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348848, "uuid": "dda3152e-d245-410b-96bb-607d8c33ffd7", "comment": "Malware payload", "value": "8a240137a8c116a7821b047a121876fd", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348848, "uuid": "956aab51-df08-4477-a74e-b540d536d970", "comment": "Malware payload", "value": "ca4153052cc85c3bfd09eff40e00b6c21c07d7e00a2714a13806131eeb660be5", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348848, "uuid": "4b865ac1-6846-4c5c-8962-438285c98c94", "comment": "Malware payload", "value": "f8e8c1cc4d22edf55c64f0baa25cc65d280d10ed", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348848, "uuid": "5a8fbbb7-7069-4fc8-a3e7-1c27c1f64e5a", "comment": "Malware payload", "value": "e15935e642e321a5bb7b77529012d96a5e19fc13b832d06f8ecb6163c59dffe9cfe16e99b4d009b87e4a871e0fd80ad4", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348848, "uuid": "6bf236b4-f6e4-4755-8383-e22d5a4a7c26", "value": "T1A9D389016C536875D824827B9F0C5AEA44DE03E69A3B748A2DCEBAC1EF532F7C136C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348848, "uuid": "05bf946e-93f3-487f-88db-fdf54c43b0eb", "value": "1536:vvtmuDml/MnRQBRjRWIFTIbdf7gGNp7sK6xHFVVblPrVbJAZkJ5IEP7bMXHy8X8u:vgp/MRQBRjRWlf75NGJFVRnA00y176", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348848, "uuid": "102bb400-058b-4489-b2f1-4ba49d1e989d", "value": 135395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348848, "uuid": "0dd3842b-a23d-429f-97d3-1b1b04d5d500", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348848, "uuid": "9e6a6d05-f11d-4bb9-9414-0d78027db90a", "value": "PurchaseXOrder_W2434200.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2357fdee-9516-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786405773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405773, "uuid": "6a6140a4-1068-4422-84dd-f78789f1286e", "comment": "Malware payload", "value": "24493926dbad83284b1b3e87f2ec81d4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405773, "uuid": "69b0336d-ef15-4365-8adc-8c799a5d2a35", "comment": "Malware payload", "value": "ca67190aa9dc8b5de33ed8d29e8b7d87d9057cb1835ae9cc3fa727abc1958b4b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405773, "uuid": "040859cd-d2b6-4c14-a238-f99fb4a9df32", "comment": "Malware payload", "value": "c574199276c98c445c6e81f1a6af596b834f2fb8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405773, "uuid": "63e7fd65-0cbd-4c8f-85fc-a1eac3caedb7", "comment": "Malware payload", "value": "01ae4fd8ea3498e000b411eb33eadf5c994afb062d1a9c3f283d914ab92f84403d000c7903ad7499774449b095e1228a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405773, "uuid": "853e3285-de7d-453e-ae9e-495f4f4376db", "value": "T12A016FD6894069005059D95E62D752A4F820D3CF464B4BB8BFDC9D3DFB98504F066F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405773, "uuid": "a20f6451-18dc-482f-8efb-6ed875c82eeb", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauNFCa1xnCN5gCXyxwpCm5cwsCouauD:kXCKysE2hi0ziQvZohauXvl0rp/5cHU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786405773, "uuid": "c668ae84-a313-47c4-8175-a2d414792b60", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786405773, "uuid": "3480afe8-2a3d-4427-ad43-9411f5cea467", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405773, "uuid": "8025c9d0-af2e-49bb-ae7d-fbd02eeb62b0", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0bede1-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786370539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370539, "uuid": "73b5f7b7-58eb-4e0e-9766-752da783f871", "comment": "Malware payload (XWorm)", "value": "597141024ce61f1f44a564ad89d880a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370539, "uuid": "eaea030f-35a0-4448-b30b-bffa23629841", "comment": "Malware payload (XWorm)", "value": "ca74733d5f423af13671c460e53587b84c269dc758daf6392854c10ed9cd4d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370539, "uuid": "053c0930-9e88-457f-bf1d-85692fa87650", "comment": "Malware payload (XWorm)", "value": "d0801664c28116bb80b6226750210a02f4275eba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370539, "uuid": "fe8c947f-621b-4778-bbe7-c5c9495093e1", "comment": "Malware payload (XWorm)", "value": "51626b93c0ebcebd6b8b438aec7258cff15bee96d21fd4e1f2f342220ae25dd1dac6ea640e19df72b7791fbd3825598f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370539, "uuid": "8a661929-3942-4bf7-8a73-5eb4105b124f", "value": "T1DD15F1185B98CD06C86E2B74A8B0D5380B759E59F912D3175EE4FEFB3CB6B228C15243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370539, "uuid": "ef57839a-8973-42c1-b050-c644de82b21c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370539, "uuid": "501a5d61-de16-488d-8bf4-cec1233897eb", "value": "24576:HAVvV0L7lJjMW3ZEuFMVsIMYHABEXOm6sTuNjW:HAVN0LEuE++AsOXsTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370539, "uuid": "c9185289-83b1-4844-8afc-cadeb90f24ae", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370539, "uuid": "d20773c0-05ac-4650-b5a9-70d76f967384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370539, "uuid": "97e2cebc-2a0b-417f-a4ef-01bea7b54a2b", "value": "ca74733d5f423af13671c460e53587b84c269dc758daf6392854c10ed9cd4d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bd626c-94a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (MeshAgent)", "timestamp": 1786355313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355313, "uuid": "e601746f-db30-4332-babc-cbb5b0cd77d8", "comment": "Malware payload (MeshAgent)", "value": "314e2238873bfc20a1357292bbfb3fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355313, "uuid": "c02d7fb0-6ae5-4770-81e3-be5dcc7c77bf", "comment": "Malware payload (MeshAgent)", "value": "ca8f173b7f0f76ffef2672776582a05434138b4e0fcbd738157268cc54d32231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355313, "uuid": "adbe5d36-86ac-49c0-b7b5-8aa276b87343", "comment": "Malware payload (MeshAgent)", "value": "a7bc8dc48a4d59fbbaeb36b1d0201203dd6861b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355313, "uuid": "e80473bf-c878-488f-b850-ae6ba5faacaf", "comment": "Malware payload (MeshAgent)", "value": "b37609764b505f445edc9771c230d9bdd8825caa4a0f3003b2010ed3a4ff4e710adb6d0897a6e6b02136f3f4ef0a9892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355313, "uuid": "de3cce5f-b896-4685-9dce-6d80772bd746", "value": "T1D6068DD267A700E8E976F23C85468527E7F1BC17233097CB95647B691F336E12A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355313, "uuid": "ab0472ea-dc3e-4010-ab50-620b791698d2", "value": "ab79d9794db3da3a9b64f0db85bf0d8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355313, "uuid": "2ba748be-b38d-4b41-af69-ea35efe1af19", "value": "49152:lNB0e9ktPvusi6u5h8/6SzHKTFjxVUhd/3xnpGebOkWwtM9wGjyUQwCFZmCBaGuy:lNKPGzh8jUmNRDkJAw7ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355313, "uuid": "d5535eab-79e1-42c4-a51d-f99a8ee33d63", "value": 3683370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355313, "uuid": "648cd4e1-f630-4b39-b711-67a3c4ac892d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355313, "uuid": "ed138bfb-851e-4daf-a4e8-aeddc608376c", "value": "314e2238873bfc20a1357292bbfb3fde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79df0bae-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786371988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371988, "uuid": "d5c39418-f8b2-4d4d-a46c-f85db481c85a", "comment": "Malware payload (XWorm)", "value": "5d9997eb0466970cca9ff5a18876a811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371988, "uuid": "99a0cb0f-7b7b-4b4e-aace-50d231a71f22", "comment": "Malware payload (XWorm)", "value": "caa9883ba21891f0ce00e1e4d85e6d8f23bdd1352c0c94d0359672b92cb45dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371988, "uuid": "b2d80515-7728-4271-b662-ffc0735da93a", "comment": "Malware payload (XWorm)", "value": "94df31aae56850954df48e1b1c75033f8b1e9bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371988, "uuid": "0b4719d9-9079-4f7c-896b-07f2c4b88104", "comment": "Malware payload (XWorm)", "value": "15e900b8a8e164052ebe8598f32d7bafea4bfd7804033fbacb603dbec2bf9cf64e38bc090370f941a238589767e6a0a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371988, "uuid": "668db05d-3c61-4445-a033-fa2d1c8449ac", "value": "T1FFF4125D660BD503C54507794DA2F2B013B81FCDE902D21BAFDC7EAFBA66B5A8D800D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371988, "uuid": "6384465e-a887-43bf-a3a9-66b63bbda536", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371988, "uuid": "9c5e5014-3af6-4db6-896d-e3cbd68c8799", "value": "12288:I1xslJdbZLZJzpFFC9wyNgUpQpilILjiLY4gMx6Kzer/iNli0ECEf3qin2vtZ/:WsTZJnd+gXpidLY4gTKzeuS08qi2v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371988, "uuid": "254830d0-77b3-4cff-a7a7-bd8231375e21", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371988, "uuid": "9a29b2d9-8c4d-4dfb-ad80-cd61f686d61a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371988, "uuid": "3e703de9-6116-4372-b4d7-22e846f2415b", "value": "caa9883ba21891f0ce00e1e4d85e6d8f23bdd1352c0c94d0359672b92cb45dc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb805f10-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371696, "uuid": "a10d2ce6-8ded-463d-a245-b55be12de172", "comment": "Malware payload (Formbook)", "value": "f83608fbda4090a3ec2c1e488c32ebf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371696, "uuid": "9ac116bb-8fc9-4311-b4f7-8bd755b84018", "comment": "Malware payload (Formbook)", "value": "cad2b76c9a651d79790453829eb7b68061b64442610e3972f2454b650a86b51f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371696, "uuid": "106581a8-72f2-4edf-9f79-d2b086210db4", "comment": "Malware payload (Formbook)", "value": "c53614859d45fa7db60a17116584567506689094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371696, "uuid": "24a86296-de65-4098-a773-4c671094814d", "comment": "Malware payload (Formbook)", "value": "169f4b62c24ed8d33bb07847917a3807e1e79147cc6fb1dfc33ad4654f86b4c0882a4cd23fd859854ce0c1bc62defddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371696, "uuid": "bd62316e-230a-43dd-b2a7-31261371dd25", "value": "T1672522584A05FA13C61953B56F32F2B103AE5CE8A540E3268FEC7DDBFA27E149C14293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371696, "uuid": "0ba3ac26-ee49-4548-8183-cae60b156dac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371696, "uuid": "9c38d680-d065-4aab-afab-028a1d85ffc0", "value": "24576:L1gruUssvI1Esr0T4yQGLutfzlhE0wWxhG:L4aurEWL8rwWxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371696, "uuid": "c437f63c-3620-4e6c-b862-536244f74180", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371696, "uuid": "f0fdcdd0-10e6-4b2f-a06c-df70c737463e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371696, "uuid": "6abefa39-179b-42f5-a0c6-ec45037d46ff", "value": "cad2b76c9a651d79790453829eb7b68061b64442610e3972f2454b650a86b51f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1520f493-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369242, "uuid": "ab231318-d541-4776-8997-31e5674eb292", "comment": "Malware payload", "value": "edd3c5114b0ed7a300d7ebc3fa0bc4e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369242, "uuid": "de13d12f-b3b3-426f-a7f1-d5a76490674c", "comment": "Malware payload", "value": "cadea8b9156f1c80438584e73850070267b1de3d1d5713e2c0a7cff19f97928e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369242, "uuid": "f5f99eeb-48dc-4fae-94b5-bc0eebf35795", "comment": "Malware payload", "value": "7d3aa01a7ba29a70419dd1ea9c1b6032114aa2c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369242, "uuid": "df634e9b-3aa4-481d-bdbe-c7e889bb850a", "comment": "Malware payload", "value": "93766446ec35d75bd46434544d3ab5479170dedd8c780bff1df890015ec45ca1fac155560bcfda31eca2795bc81aa128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369242, "uuid": "82ef50ff-e88f-4d3d-90dd-6c77fe49e779", "value": "T12435F1190E866B99DABE0F78C1A6089837F0C94793D6E7173FED11F58AA3784CE17412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369242, "uuid": "88fa94a1-660d-4621-abcb-aca12093b592", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369242, "uuid": "f63f831a-64fd-4085-8af4-e05f1ae9ec0d", "value": "24576:13RqqigNf0NSIXtbJXsFxWbVALNUS9kQO:hRqP200IpJXixWJALmFQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369242, "uuid": "46216eeb-e16a-4a3a-8bca-dfb5a3aeb5e6", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369242, "uuid": "df2883af-14ab-4e54-adb0-d1a39774b302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369242, "uuid": "08b1815e-bfeb-4c80-8f36-df6a66fffdb1", "value": "cadea8b9156f1c80438584e73850070267b1de3d1d5713e2c0a7cff19f97928e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf23057-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368826, "uuid": "f87490e2-8ab3-4bc1-a596-54271479ec5a", "comment": "Malware payload (Vidar)", "value": "b220346bb6ed695fbb4d65495c57da1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368826, "uuid": "55097084-dd2c-4016-ad46-d539f9c505b2", "comment": "Malware payload (Vidar)", "value": "cbba62b35fa868a0e9a1c8466d3011df7a1c827404a0c7193144f3f4a42fbf24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368826, "uuid": "f5b5f285-2bba-448e-863b-75ca290277d6", "comment": "Malware payload (Vidar)", "value": "0cbc2bea7a13e47ca27012bcc1c4bb0c2198f69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368826, "uuid": "50a191b2-796b-4725-adf6-bd4a6d5dbf92", "comment": "Malware payload (Vidar)", "value": "f37b8db995fb30491b6be1b314b9aa7cb7ae9460ad83690209b84d2694b57ef62ebf810aa14e05beb7e0186ac59f4f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368826, "uuid": "3e7bf82b-1a1b-4432-9f7f-82afb340d8cc", "value": "T1AF422A8472E5E2AED49EC175A96F14ABAF663041130A4EFF33A845913BC3121337CF88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368826, "uuid": "05a45b06-8e41-46b0-b8ff-9b7d623b18aa", "value": "6d43e0aa8711ce962f40384eb6f2166b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368826, "uuid": "91530683-697a-4986-b3f0-2acc543d43a5", "value": "192:OK/KWwOpQrWAgpdsfCyoYj8RpNmX1ryTmZ3VL22:OK/uEC4SCU4xmlryTqlL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368826, "uuid": "9da83203-1814-4591-86e0-7d5536b3baed", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368826, "uuid": "424d5d49-37c7-4844-96a1-cfead656cc3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368826, "uuid": "54ad1159-cec7-498e-8362-1b6e8313879b", "value": "cbba62b35fa868a0e9a1c8466d3011df7a1c827404a0c7193144f3f4a42fbf24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c4f442-94af-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786361642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361642, "uuid": "e2ce3f76-f11f-4a24-8f30-7757da856c10", "comment": "Malware payload", "value": "b17d7d8afcd0dd1b7f0a107264bbf7fb", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361642, "uuid": "0443ef51-72a5-4c00-b725-8887eb47aa6d", "comment": "Malware payload", "value": "cc4190819ca8193faab7b0852e7e65a065f4968448d88b706aa297fb1d1505c1", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361642, "uuid": "14d6156d-ce4a-4ea2-91a9-54764233902d", "comment": "Malware payload", "value": "deacc97b7912678a6c87ffe12d33ba2ff4759a7c", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361642, "uuid": "68e86313-ff2b-4891-92b3-ae56934d068b", "comment": "Malware payload", "value": "be889561da6cf31bd2e4d55d27a49b2b8edfe0fd45cf737271f1230dfc619656c74bfe5a9615bbc8c6e97352d5dfa5a5", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361642, "uuid": "63266c76-9151-4d20-9b30-752f12b5fddd", "value": "T1ABB6233FB287753EF0BA5A3979B2E214643BAA1165524C5697F0C84CCF190B01E3E79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361642, "uuid": "6d593cde-9fda-4708-a7c6-3ebdcf7543df", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361642, "uuid": "158b10fd-50f2-4cf7-922b-255a5ff4c2d0", "value": "196608:n/6u+HGFnqo2/HaypvB/JKtASSOCKU1jV/7sboIu1qbcYy02hmFLKVg:nSu+mFnK/4WSSOmB72odIbcYy02Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786361642, "uuid": "69006c5a-8968-4eff-a147-9612835ce8a4", "value": 11020696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786361642, "uuid": "ad9ed716-44b1-4d6c-bd0c-257deaa062dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361642, "uuid": "09d2abb8-8d05-431c-abb4-52882562f160", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaa7ac9-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786372936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372936, "uuid": "dfc24f55-346b-4760-9971-2011cb9fc441", "comment": "Malware payload (GuLoader)", "value": "e55b18aac6ae22a1aaaa5346986dd4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372936, "uuid": "0ae95262-1896-4ee9-b5a0-bbbf90b71933", "comment": "Malware payload (GuLoader)", "value": "cc41a78866c9ee3da7038c470e985bf4658317179e0156c8f606ae0a7bf6672d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372936, "uuid": "dcc2ef07-945a-4879-be0d-d8360ef96db9", "comment": "Malware payload (GuLoader)", "value": "cd67577a85f91c0ff22b459ed5eec0d15f2630e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372936, "uuid": "a5139482-627d-4b4c-8aba-f86897cf60e3", "comment": "Malware payload (GuLoader)", "value": "e07491ec74afb2a8de936a403dfe3f77f3078ee52f617d864efffdd75710e85fafccca8cc7723c78ac4e448e34e7c344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372936, "uuid": "ca65cc68-8892-4450-97ee-5903dbf34e1c", "value": "T1B8D402C0E7505C36D2909C35CECB86A6C7A87666D1B785F2FD30BD5E287396219CBE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372936, "uuid": "e0810d5f-f709-4288-a441-4220ce93b4da", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372936, "uuid": "a0d8a158-168c-43b9-9ac5-8be2e8732ca9", "value": "12288:YTA5I+1AlMW0aBnj002Y43VKuEHV+nxTo8+sMX9dkmE2fV:YTA5IXSW0aFA0P4lJLO8hmE29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372936, "uuid": "6e140237-48d1-4681-85cd-16b3218c1c4f", "value": 616376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372936, "uuid": "25deb9bb-22fa-4b81-98c9-e30f9c4689f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372936, "uuid": "1bd88f67-4a4d-4b49-8d01-254fd511f782", "value": "cc41a78866c9ee3da7038c470e985bf4658317179e0156c8f606ae0a7bf6672d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f96862-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369455, "uuid": "56f21297-1bd7-456e-8691-66d5b0de94fe", "comment": "Malware payload", "value": "c62ff6a18470b755559f5efed726c60b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369455, "uuid": "6d849343-c8b8-41dc-b0df-fd5cc38d7856", "comment": "Malware payload", "value": "cc7bbc5d530b86712aa7e05267503f0dd738932b98497d68be947fb79fd995df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369455, "uuid": "b64627bb-3d8c-46df-8edb-bc97e349e20a", "comment": "Malware payload", "value": "2cd22a25bcb9a3dc03c4f8025537bdb2004d5362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369455, "uuid": "564d9dc6-64ed-404e-807c-85053b239bd2", "comment": "Malware payload", "value": "b758a9f3812e726e0a371334c92cdecb18eba6c1faa90cfe531a95592aaf23d1877446a2ce402d857720e04208ad9079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369455, "uuid": "7f310d87-dcbc-4ede-a862-e8e44f3346e6", "value": "T18735F1191E863A98DA7D1FB8C172089837F0D5578399EB273FEC01F5DAB3788C95A442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369455, "uuid": "7f6ad280-577a-4669-b4c2-1ec1c0d899ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369455, "uuid": "fc496300-210f-490a-844a-c6990cf3f225", "value": "24576:OH3O4jqqigNf0NSIXtbJXsFxWB6HzLhEw2GClG:0jqP200IpJXixWIHzdEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369455, "uuid": "dbf2d4c3-82c0-44f1-b00c-2b1d69751dd4", "value": 1135616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369455, "uuid": "7c48d684-4f29-40bf-acad-1f0bec2d98a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369455, "uuid": "5880e427-51ec-412a-8027-94e8223dfc05", "value": "cc7bbc5d530b86712aa7e05267503f0dd738932b98497d68be947fb79fd995df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77954a42-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340202, "uuid": "b0c0bb0f-3b86-453c-b853-90aaa60b42ac", "comment": "Malware payload (Mirai)", "value": "cc2f814bf5881f013ac3d120c777745b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340202, "uuid": "41879984-4ec6-4b16-99bb-c631a50b9d02", "comment": "Malware payload (Mirai)", "value": "ccb14626cb8e643e8076276b1cee3a3a4fa3996845920f8e4be238d3a33a54f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340202, "uuid": "b029b52c-e384-406e-a013-efd3f25d6ea5", "comment": "Malware payload (Mirai)", "value": "f725e05bde0d7132d6756dde3763dfd605e9253d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340202, "uuid": "f1f8ab2a-f300-4c8c-a8b0-f174ca213571", "comment": "Malware payload (Mirai)", "value": "81556c02cf61969fd260d7784fbdb2159126ed26ff5c1b489164ef947cc4409d05be008a4fd2e8aa9b35dd73dcfa48de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340202, "uuid": "b1df2b8c-6a33-4cbf-b416-33f4d14cf383", "value": "T119641A48A2F1E3EDE164E9705319BE1B4C71463730937186F39FB97363A71804AE9A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340202, "uuid": "b700e51e-077f-43ee-8443-a924cddae158", "value": "6144:6Na9bDzkzmEvEFqG1HcrJIvTyOCRgyUogTpbHMc:6Na9bXkzmEcFqQHjvTyOrvogJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340202, "uuid": "f39494a4-8646-4af4-96eb-8a22bc925ecb", "value": 332092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340202, "uuid": "385730ea-3e09-472f-96ce-2c6c8b5c4562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340202, "uuid": "61203e3f-7f02-49b0-85a4-a3475b191ea7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e306840-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327784, "uuid": "20f7456e-f3d2-4cdb-96de-2127d97ebc0c", "comment": "Malware payload (Prometei)", "value": "2f1a5bed49a72973b26ead70df742e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327784, "uuid": "96475109-4066-4052-ba96-2b98f2ed0a26", "comment": "Malware payload (Prometei)", "value": "cd24f0432e2492359dd91d611a2117b949dc991e03cf8e940875cc30c8c95b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327784, "uuid": "ad488328-1692-48e9-8c6a-5c5858faa33b", "comment": "Malware payload (Prometei)", "value": "5892f26b63dfc2b404a8311b8db36ce1a1581529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327784, "uuid": "ebae1d01-7e27-4a18-93ea-a7374d42e1bb", "comment": "Malware payload (Prometei)", "value": "87014a3b3b54cc6e94ee10c3d9b0c3a648c5890c46c5dbe7ccc95b2cd0411f3c8fd3d71def78f20694d084f695a93f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327784, "uuid": "34b32352-9448-4f85-be26-1b025c9d8f04", "value": "T16D74DF6376B8F05EE8D157324F47C74287A93F949892E09E39B4230F2C656549F38BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327784, "uuid": "295eff24-5dd7-4f33-9907-e4aff358d0c5", "value": "75f85177e42aca4607666d9186f1316a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327784, "uuid": "71b6e02b-6f9a-4e5a-a725-a09ee8c353cb", "value": "6144:4zNIwwaJjEpW95NCdlfGW3lYl5Z7LS5u/ZqaUbki42u6n9FM7C4bz3:4zNIwwOjJ95NCdl7YRPjqo2uIFMzbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327784, "uuid": "07854e55-dc91-4e9a-b611-fac9d83319bb", "value": 340576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327784, "uuid": "3106769b-7be0-4662-88e4-786b5cca246c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327784, "uuid": "67ce5bae-6ca9-4205-9dd2-1ff0c185f25a", "value": "8a0aa04876b1221d0330ddfb7a4153c80e9eec24dab9c1fc2801fa5a14076ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13804edd-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373964, "uuid": "4f52a378-4c04-42c9-9b4b-2a5d6e92da5c", "comment": "Malware payload (PhantomStealer)", "value": "31069d2d180bd6fcd8400be270b98be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373964, "uuid": "ab3eb146-2126-4f83-b47c-08254b331470", "comment": "Malware payload (PhantomStealer)", "value": "cd336c8d2e301369fb27c5cbbe02dbf73f5bd797307cca781104460effa803c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373964, "uuid": "fae7301a-2f64-4188-a321-d789c224327a", "comment": "Malware payload (PhantomStealer)", "value": "8c8b3e9fc1b3d02ec2535334eed44155318076db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373964, "uuid": "c10aaae6-9e56-4bf1-ac3f-ae2b715d4492", "comment": "Malware payload (PhantomStealer)", "value": "490451c79d1c75832dac6c001594a23d715dd8387b8a3db3507a400dfecae03b71549f1b7f9e37966676cb6ab93d6aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373964, "uuid": "598a1a80-bcd2-4a8d-a175-0370286e273c", "value": "T13E3523A41752DF12F8761BF42963E1355B783D9EAA36E2460FEA6CDBB393740A014703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373964, "uuid": "3e69853b-6e03-4e2a-a9cc-8cdc6a1234d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373964, "uuid": "27f34331-81b1-413a-b47f-d738a8efe46b", "value": "24576:gUJ51iRD5Zhi/6fjWHcyyMsXQGKn/+EMvqhTNpw0F8Ez:d9iRjUJcyyMsXQGKn/+EAapw0CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373964, "uuid": "d6f1c8e3-8fae-459a-b482-8863c61d5aad", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373964, "uuid": "8567f7bf-d429-4603-acfb-248dca29f86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373964, "uuid": "28a5ccbe-13c0-41c9-9d54-ba1fc5d51140", "value": "cd336c8d2e301369fb27c5cbbe02dbf73f5bd797307cca781104460effa803c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84423be7-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372435, "uuid": "fdeb5602-3f9e-4451-bb19-07b73c2f8702", "comment": "Malware payload (AgentTesla)", "value": "f8cc2a067d567c297c5f0600770bfd37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372435, "uuid": "b93d8f7e-cf89-43de-ae45-e9372b357bc1", "comment": "Malware payload (AgentTesla)", "value": "cd51018b4d3c524349a91c511a6e57b769c4f004c708d9fd6f13aa71cae08411", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372435, "uuid": "11d6d3bf-3186-49ae-808c-d72585921f08", "comment": "Malware payload (AgentTesla)", "value": "b06d2adeebe33b1044e8503e8feadfab029ef07d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372435, "uuid": "a982582f-e4ed-45bf-92ba-d897d1fb0f31", "comment": "Malware payload (AgentTesla)", "value": "75f3f7c8be61f4807b11a044bed02608433d7bf2ca0f5caa92e816b941f721b908db172033d67779af06448bd2506767", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372435, "uuid": "4f4a471a-82f2-44da-b9b4-e1367e34501a", "value": "T159647C2B3A896E35CCE169BE38D37EB473D3EBFC254446C3210A67463835A51469E738", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372435, "uuid": "21a268e7-8289-4370-9a64-1e15b67cc9ae", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372435, "uuid": "7a8a7cf1-3113-43c8-86c8-1be3afd563c3", "value": "6144:Yh0sesiM+Hz5+LykB61h1vQ2/cIjXkIRCUuGZvLc7AZny:hsiM+Hz5+Lyhvz/cIjXNRttvmAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372435, "uuid": "a2cd028d-2313-4144-bfe5-ccb1dc081b32", "value": 310160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372435, "uuid": "2f910257-b6c3-47d8-92bf-b335519d57e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372435, "uuid": "c159c9f6-beb2-4b5b-94dd-636ca6593c85", "value": "cd51018b4d3c524349a91c511a6e57b769c4f004c708d9fd6f13aa71cae08411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317c606f-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1786349533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349533, "uuid": "44de9460-035e-4741-821a-27ec73ebbc76", "comment": "Malware payload (ACRStealer)", "value": "543c2c2319b6ac58c75a7c9aca798292", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349533, "uuid": "7af4d7ed-ce9d-4fa0-94f5-aee0765b79d7", "comment": "Malware payload (ACRStealer)", "value": "cd598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349533, "uuid": "52136c28-66bf-43d5-b475-3055d3c7ccf1", "comment": "Malware payload (ACRStealer)", "value": "958380a31cb33dbf14ba010be64a6a5fb00aa24d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349533, "uuid": "d7c4a854-8a75-4cf7-9e42-3b82af5f59d7", "comment": "Malware payload (ACRStealer)", "value": "4b14b304406e3386423aa9bfa988e47d0d684083c49f713eb2ebf2f50f55bfca766c0c165f4d0899f36b24785c188fa8", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349533, "uuid": "af8b7d84-b046-44e9-86ee-4698210b65ad", "value": "T110F5C4E12653E04EFC6841FE1F1BF7542B4E9235A12C535DE520AB88801F7739EADA1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349533, "uuid": "a5d0675b-12de-4ef8-8a60-47435eb72d53", "value": "8fbe7769511bc373ee175b0060be1906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349533, "uuid": "8ab70542-722e-43ec-a371-936a38ce64f1", "value": "24576:knSoKp2ulq70SV0hEqE8XBC808ycu4eWg7VJPmJ9BaSQm3XFK7PB:2sl7Q2yfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349533, "uuid": "dbbc4bc0-35fe-4710-b514-77003d9c312d", "value": 3493376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349533, "uuid": "b1d17be5-463b-4cd2-b40d-d12e3a5b1ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349533, "uuid": "3c0fe2b9-dee4-4c1c-9261-5adcf2f14fc8", "value": "webdav_payload.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb6744f-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368534, "uuid": "928075cc-46d9-45eb-9b17-6f5ce4366060", "comment": "Malware payload (Formbook)", "value": "52126a518a3f80639c16d4c6499b932f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368534, "uuid": "7e982418-9750-48d8-85e0-a26b86770534", "comment": "Malware payload (Formbook)", "value": "cd7983d51cd29a0dde0ec1d149d0ada57b14dbd4f29b40e3c8ce325bd855b8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368534, "uuid": "54d97b69-6db1-4f2b-9fee-b2691d78b52c", "comment": "Malware payload (Formbook)", "value": "ace8eb5e55def1e0817958adf21f497814d48cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368534, "uuid": "ef8767d9-28f1-4573-89b5-892da8b21ef5", "comment": "Malware payload (Formbook)", "value": "8cbbc4eec8df97b23fefed8baf66a7348b9d4e3cff1a3de216efdd697dcdd6c8f533607e9f4b103805b7ce5f084813d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368534, "uuid": "38419739-cefc-48ae-8870-0ea3cf9bf370", "value": "T1C325F1C03B2A7705DEB4A6348576ED7453B52E38B010FAE66DDD3BCB79992019E18F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368534, "uuid": "5f6ae0cb-d0da-45e0-92dd-a34a4300894f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368534, "uuid": "7eb82680-1ea5-4448-a74a-d7d5785a615c", "value": "12288:w+zqZ47iqRcMLzk57OH1uBFLOlEXssmivQTOwjrWArHAIAr5kQxhbjU1y0K1IEwm:0qGqY5qWZJmivQJah5xj2y0llA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368534, "uuid": "5a00f136-df36-46b2-ab7a-ecdf6560e177", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368534, "uuid": "b27760a5-155d-4e09-a8dd-3e1d2f855f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368534, "uuid": "faf4fcc2-60e5-41a6-a66c-75def42deb0b", "value": "cd7983d51cd29a0dde0ec1d149d0ada57b14dbd4f29b40e3c8ce325bd855b8a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78114982-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368979, "uuid": "97463823-26ff-4dec-880e-6806f0c09d9e", "comment": "Malware payload (RemcosRAT)", "value": "e17d23fd7d9a49875eb2ba554a88bb28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368979, "uuid": "f188fbb7-4710-41ec-8750-fe16ae832411", "comment": "Malware payload (RemcosRAT)", "value": "cdbbfd6bc29eda040e49c2c1ee5a1b11eea48839490679ec0af62884af26a34d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368979, "uuid": "b4f6fe40-1494-4277-ad2f-35c6a6b9d0e2", "comment": "Malware payload (RemcosRAT)", "value": "8cb0363a074c0690c4e2df161ee5dca8d7f633e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368979, "uuid": "ed1bc4e6-b6db-44f1-8cf8-f9eeddefbfd5", "comment": "Malware payload (RemcosRAT)", "value": "51d4143268ec38fe0c193460762dd70c8e5f4238817669ebaf06dad96840c73334fba265c69722c70d9353a0628fc2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368979, "uuid": "820acc52-bc20-469d-b58d-0cf3e4b71790", "value": "T10F4523522BB4CA21D5F503B046F2E27057387C2DE512D37A8FEDBCEB7429A05A594B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368979, "uuid": "af120fea-0927-4402-a910-39d55571791c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368979, "uuid": "33da1f71-afda-4cac-ae7f-1292a49bbee2", "value": "24576:kvQ4wii4JDHWg13g4ZLAefIYk7DFY85kkP0O/sXjJshbY+MAeZ7IN:YQ4AqDHZ3giAegytsVhZeBIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368979, "uuid": "f8814bb0-ec0f-4803-a4bd-14cfb878e288", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368979, "uuid": "a7032214-499f-44ca-a9ce-9a87392fc719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368979, "uuid": "d0ccb2b1-17f9-4bc7-99a9-82418b8cd8a8", "value": "cdbbfd6bc29eda040e49c2c1ee5a1b11eea48839490679ec0af62884af26a34d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6815f6-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786373365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373365, "uuid": "43d1222f-ec74-4141-8dc2-0c37d2ad91e5", "comment": "Malware payload (njrat)", "value": "c07448da815570ca7dcaf3f3b51749bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373365, "uuid": "97d914a0-7f3c-45c5-9493-e215a878f2a4", "comment": "Malware payload (njrat)", "value": "cdd0de087bb075758a59ca14fdeefa7d555aa67ba5be36d1019f90fc272a9ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373365, "uuid": "eabe790b-000d-4cd1-8d9c-457c954b8e7a", "comment": "Malware payload (njrat)", "value": "40e9be4e0a954d6bb2630b0207397f2e3e4182d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373365, "uuid": "989bb245-d144-4668-a328-216aa7e00e86", "comment": "Malware payload (njrat)", "value": "990608cc104cdb1a9af2d14c70a4343188c840d4cf36d9e7825a8038a1a009cdecd0de72a4c9197af0b344f4a2a2fef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373365, "uuid": "6d4c2eb0-562a-4d69-887d-4366db01ad4c", "value": "T1151501150316D952E4EA87F2B8B0E33433A55DCF79E2D2D25FE66FF734193812A58282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373365, "uuid": "1972b925-b2bc-46d9-aed1-3431badddbe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373365, "uuid": "f614c1bb-d3a9-43af-af0a-ac92c93331ca", "value": "24576:ep50IRCpm6Ur4+ApBuQUD4hxcaufMSIR7yb:epICHmwQKpfMSIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373365, "uuid": "12d6cebd-fc06-4214-a303-a4ebfc64a0f8", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373365, "uuid": "6ddd6e4e-354c-4497-8b61-ad22619e12e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373365, "uuid": "f4e6b58c-72eb-4e45-ac9f-8e87e38d7891", "value": "cdd0de087bb075758a59ca14fdeefa7d555aa67ba5be36d1019f90fc272a9ae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818232b3-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383598, "uuid": "373e3a78-b7bd-4efc-bd27-7e201e609300", "comment": "Malware payload (Mirai)", "value": "c69154fc4aad439d4cd402ce820c4438", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383598, "uuid": "9d0696da-232d-48fd-87e4-3e30ce035400", "comment": "Malware payload (Mirai)", "value": "cde564804325b48d813f387ce55fadeb065dc3938148671d2be5c78689cc4669", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383598, "uuid": "e49ad176-2581-4a7c-83d8-1dcf257af8c7", "comment": "Malware payload (Mirai)", "value": "d19095ca196310926185ed78ee123c38a0251eae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383598, "uuid": "cb9b6f8f-595a-4a6c-9989-ebaed105248e", "comment": "Malware payload (Mirai)", "value": "acddb5cb5d96ca6050a1d2adbd96735ce46372ef153071fd08939a876a8dae3054c5655bb91fa1ba5cf47ff8f1e4d27f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383598, "uuid": "052f5bde-cb74-4b52-861f-c063e6c75f7a", "value": "T1BDA3023B6602D9EADC7632BF67F203C68A654261C365994A33C270959F031C5BF634E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383598, "uuid": "33589cc9-d053-420e-94bf-a9b9a2a0f759", "value": "3072:ZEEDqq+Imz80XdjPeNIQ/dgvzZ7kUqzDCcXzorRgVeAU/5VEk:cTPe7uvzZ2nnz025UHEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383598, "uuid": "41140de0-dace-4681-9e2d-12aa51181c66", "value": 106328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383598, "uuid": "e735c995-3dc5-4ccc-8cf1-e570ca1e9a09", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383598, "uuid": "47021da6-2407-4ab8-ac4a-0ad61dc2e562", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326ddc3e-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356836, "uuid": "82b6ab79-a17b-40f3-bf9c-7b78135aee15", "comment": "Malware payload (Mirai)", "value": "faf7ddceca34e8ddf6923fc19a27bc1d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356836, "uuid": "816339b5-27d6-416d-8c16-cad1d8c7b24b", "comment": "Malware payload (Mirai)", "value": "ce09b63cd78f45022473b9c401c067096436b025d427cd8251e9e9c7d2b59630", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356836, "uuid": "75ad84ee-a1c7-48de-a658-9fec960db22b", "comment": "Malware payload (Mirai)", "value": "d6b7ff6e310d2bf84770a30150624c6872eedcfa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356836, "uuid": "b26c77f6-740a-459c-a462-16506d86ae0c", "comment": "Malware payload (Mirai)", "value": "91689fd055d93a43b71272d757643abb992cfc26f4874395a5fb27a41cb5efc4c12fc0488ff7729f9551d97f912a01db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356836, "uuid": "147f4c2a-e818-4a0e-aeb4-3b0c89d08c12", "value": "T11B14C097B74B09E0CC0602F80BCF6FAE6A2312434DBFC5EB69697B35543A4CE52157A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356836, "uuid": "609f3813-4af0-402e-ad09-afa545c69e78", "value": "3072:yrEecYLIMAVjfORPg1frmsCw4gCROv89qTYWgrCuC/i68OS5PvFrq:yNIjXr+w4nsLk7CuC/ilZdrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356836, "uuid": "9bafef0f-67ed-4a0a-b8e9-b0aa77692685", "value": 207748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356836, "uuid": "e02c9945-02f2-4d47-ae3a-c633ba47f1a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356836, "uuid": "eebcdb86-60bc-4381-8fab-f70efb1eeb39", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4014737-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372542, "uuid": "7fc5a919-110b-4de1-bd95-b31045aea83d", "comment": "Malware payload (Formbook)", "value": "0ab66eaa22d7612d9c1e5340ea9855a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372542, "uuid": "a88e4fd5-0df0-4cab-bc3b-da6804f3fbdf", "comment": "Malware payload (Formbook)", "value": "ce17dc22aa009afb20858cd741b435921ec368fdc969df89fecf6611ef59b366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372542, "uuid": "9b6e5893-c5fa-4083-bfd1-d43ca1d21182", "comment": "Malware payload (Formbook)", "value": "481457a635b0fe0135277dd12ce8f9f6d10e79e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372542, "uuid": "56938f79-e60a-4d15-9d28-fb4790cd4b85", "comment": "Malware payload (Formbook)", "value": "3b3fbcdace0975b9d6afda370db538b093f1daaec723fd3faa75cdb9158e133df6584750c958d124e709e16127337ad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372542, "uuid": "a3bca4d1-f347-48d6-a4f5-9160e953b70f", "value": "T1CE251284B7B9EF29C6FA47F00870E0304776AC5E6636E2078ED5ADCB3874B195944B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372542, "uuid": "b6d51892-490c-4010-ab2e-dbba3bab51fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372542, "uuid": "c53795c8-3e38-4875-8442-01414fc6f924", "value": "24576:G1j/Og3PYmocJN6CPvUeH7qPy/M1M/P5GtA7JPWc1rKtO9DEvs6:KPRT6rebj/wMnIC9WchK4D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372542, "uuid": "80d3bbb0-231d-4ca9-9842-33456271458b", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372542, "uuid": "a40c4a93-348d-4c20-9554-a63121bed628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372542, "uuid": "76ceade6-46cb-4929-beb6-05cffb63f899", "value": "ce17dc22aa009afb20858cd741b435921ec368fdc969df89fecf6611ef59b366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a888a95b-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373785, "uuid": "652f6e4e-26b1-47cb-b34f-c562bab66b8a", "comment": "Malware payload (Formbook)", "value": "5c6629e3f56e73f5940eb773f26a672c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373785, "uuid": "8e71d436-ca8a-453f-80cf-1f9637b2a2d6", "comment": "Malware payload (Formbook)", "value": "ce53d11110c1db9c7b25b09d4209cbefb80f241b6faa1289c6f2d620d576790a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373785, "uuid": "2e1dd661-883b-46e9-894d-0cde35137447", "comment": "Malware payload (Formbook)", "value": "24fc76758a2f0678eb00162d5d575d2d1ba50b8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373785, "uuid": "7ddeb956-087d-4421-a382-553964dd5483", "comment": "Malware payload (Formbook)", "value": "4cae192d7d97da25e03ce98c1b08e0d5b9b1c8c4859ab7edf9bbc455e65959ef53f9dc9f210eb8b7f3ca04fd4b22b22b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373785, "uuid": "8dfd20f8-7785-4208-a4d5-202643f39190", "value": "T19AA423208A798B31C92C5B38B07E9EDC1DBCFDC5E1E569D7270A78D62836A43E456F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373785, "uuid": "c012f2b9-16c0-4b2a-aab9-b3500a0483a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373785, "uuid": "5e631675-bbd9-48c8-b4ca-58b24b36cd19", "value": "12288:/nBQidx1g42ce3Z/z+4fhxvz6o7kwOQS2TInc8S8L:PnT1gdT/pfP6olOP2WtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373785, "uuid": "758ec88a-3faf-4a31-8f31-7668f0341ef7", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373785, "uuid": "5488531a-4610-40a9-9459-e5e2bf9b0ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373785, "uuid": "fde3249e-71b9-4a87-8eb0-9002a43d40b8", "value": "ce53d11110c1db9c7b25b09d4209cbefb80f241b6faa1289c6f2d620d576790a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f690b9c7-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369621, "uuid": "48219369-57ad-485e-9719-16605a4ad756", "comment": "Malware payload (Formbook)", "value": "be77290367fee894c4e1e0a51f4dd930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369621, "uuid": "f84378c9-98f8-4129-9dde-2ad8cc4a97c3", "comment": "Malware payload (Formbook)", "value": "ce72d1f428421f28a465cb794b025a4d2d8c4a29ddb1e7c4e24098eb2a9f052e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369621, "uuid": "7de8dd18-b090-4dbd-ab4c-fbe20597b39c", "comment": "Malware payload (Formbook)", "value": "235f1ff7b4b47ed4450ba7981e52d8ae1ef2db0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369621, "uuid": "137dcbd4-f26e-4619-9fb1-51b151459502", "comment": "Malware payload (Formbook)", "value": "45e3c36e3794fbc19f41978b7135e260de5a726c8c718e360c54d3cc3aba59b976f29fb18bb3534f1f9d3027fb1f682f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369621, "uuid": "b0aedb09-2fdc-481c-85d0-a5f858c315e2", "value": "T1242512948E1AC813C4C35771CEE1F7F522B55E99E852C7134AECBEAB7C79087A8189C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369621, "uuid": "b4455016-c732-4e4a-9074-d9d2f10cba24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369621, "uuid": "34d51f7c-9fb1-4f6f-9121-5c4cea45cca9", "value": "24576:gpV79IVygchWQsbFSYifUccLZXxAj/MMaikGXAAvQj:gpV798ygchWFSYcwZB5pGQ1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369621, "uuid": "69f56a26-df61-47fe-9515-9a427ed45e4f", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369621, "uuid": "b4cf9efa-e2cd-4f5d-90d0-2fdbcfd8e4d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369621, "uuid": "4c1b86ea-89ec-4be8-9e85-a46e3332c24d", "value": "ce72d1f428421f28a465cb794b025a4d2d8c4a29ddb1e7c4e24098eb2a9f052e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48de49c-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339928, "uuid": "71cde711-67ef-4e23-bf35-5d17457d7132", "comment": "Malware payload (Mirai)", "value": "aed4506e90d24e9867644dad8f834c1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339928, "uuid": "d755c9aa-2006-4746-8fa1-3c6bf26f6d97", "comment": "Malware payload (Mirai)", "value": "ce7dbda729bbe9d1ffa7fad7cefbc7ca4433c116afd7e50b684b19e75fb76682", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339928, "uuid": "8f1c634c-a70d-4117-ab30-3b252e033426", "comment": "Malware payload (Mirai)", "value": "014c001e9a45f0bd186ceef35e28321b356164a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339928, "uuid": "5c48b9b2-b1c5-4b6d-bc89-400334488190", "comment": "Malware payload (Mirai)", "value": "fabc5998672435bf63f5ebfeab93468fa70e0dfd22cf86c22d10cdd2206488c1802993b2a23cde521273a346b83b171d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339928, "uuid": "f0a2e40e-4598-4f6d-ad04-42a0a94fc80d", "value": "T126844B8452F1F2DEE258EE706311BE265D620E3730D73186719EF6B313A72445AE9EB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339928, "uuid": "a0ddc604-d662-45b9-a00c-00c6df7e78b6", "value": "6144:pIyQC5/civNYZ9uPhA8QPmoUPkvz1UAROc+veNUtf:pI2cCNYZk/exDvz1UzvcUtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339928, "uuid": "556cb8b4-e2d3-4637-857b-23f1cd364069", "value": 390564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339928, "uuid": "c384f816-3b63-42b0-ab99-b28640a4951a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339928, "uuid": "b96f86c0-ff2f-4646-8aeb-b10d378b9e2d", "value": "pid.sh4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a97d542-9498-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786351696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351696, "uuid": "a4ca6285-127a-40d0-a2f9-e8a2d5a3e824", "comment": "Malware payload (PureLogsStealer)", "value": "b348f89ebe0fec0e43a1b03b91f22e41", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351696, "uuid": "bdc0e271-c9e0-45c8-bd1f-62c3776ee407", "comment": "Malware payload (PureLogsStealer)", "value": "ced1cf088f4af2b98b1bec0220b58b30ec404d1c9d25f73a2bd6dc0997f6a2d0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351696, "uuid": "570ff46b-9d04-4c4d-84f3-ea9b2158d86a", "comment": "Malware payload (PureLogsStealer)", "value": "175cadb350a3843d795891af79cf16db400d0d69", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351696, "uuid": "54864df1-2dde-44a6-898a-bafff6319a93", "comment": "Malware payload (PureLogsStealer)", "value": "66e66ee0cec14eee85ac949dbfcd21c0fe8d95520170902bf16534a8e8ddc75509251cd76c43dea1ea89c15b54efa6ff", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351696, "uuid": "37b9fdc7-98ce-4bd2-9915-3718556998fc", "value": "T176B5232213E54074E5BA87B605FB8927A176BCA493A9EBCF33E054C94F339746673309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351696, "uuid": "2d49efac-ac58-4549-9fd3-22bcff8b17f5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351696, "uuid": "add1005e-1e2e-410e-8722-9ca45361aa8c", "value": "49152:liJy2cpE5Qhpr71AzXgaOAaH7CCGlctvbyqwJ52Gjb:liJfcpE5upGgh72l4byJUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786351696, "uuid": "a3c5999d-9fc2-4051-ac34-da4bf2a3b87b", "value": 2365440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786351696, "uuid": "084393f2-d213-4917-8523-a1dbeb25b7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351696, "uuid": "f1a6c219-ef35-40e1-a002-c7df72e3a32a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab0675f-94b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786364635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364635, "uuid": "17866832-2411-4cd4-bfef-8fd2da7ba98c", "comment": "Malware payload (AgentTesla)", "value": "5fa2a15817f06ba8ebfc21f37378a15d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364635, "uuid": "7f361c8e-87f9-475d-a58e-5bd548a48c15", "comment": "Malware payload (AgentTesla)", "value": "cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364635, "uuid": "b563032c-2a68-4b10-87fd-7a4291e8a533", "comment": "Malware payload (AgentTesla)", "value": "e6b1a344b6a5f25d8dc81e050665e13e54356fc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364635, "uuid": "ba18b2e1-6849-40f9-92f9-c8e763c99cf5", "comment": "Malware payload (AgentTesla)", "value": "5a5688885e2f338cf3f743346bca146a9bc01cd6509b68a6d22be83aa758a9a12b00085f24af632d0cc940a7f2f4767e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364635, "uuid": "d0c4201b-8c4a-45c2-9363-fc769a4f756a", "value": "T1C8E5D4822B809D33B731AB9D523ADDF0DA0A511314C5DF1630ADF6187B6DD0BA758AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364635, "uuid": "b7b6b4e6-fa12-41dc-9356-62f4876ef3b1", "value": "49152:m2jqBFAiHsZXCGUuv6etWxY4YFD9f5S53wHOPwgTh4NMVhNrQXll8cPb/QCG+kgo:xq4Ufuyef4YFD9f5S5guPwgThQMVhZQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786364635, "uuid": "305cea62-91ac-47d6-ad69-7a6ed5ca19ae", "value": 3050654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786364635, "uuid": "f25378ea-601d-4796-902c-7e310bab4b35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364635, "uuid": "259ca1e7-316f-4e55-adce-a770c1ca57bd", "value": "SOA_CD105474 _ TF912Z P10406 MGR-08-10....Pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c4d44b-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786369035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369035, "uuid": "2ca7c140-43cd-466b-9503-2eb2ccec927e", "comment": "Malware payload (PureLogsStealer)", "value": "7b5cf9dc8624c6516b624c1ad206e886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369035, "uuid": "5047c893-8034-4d45-91e4-1de443e6fa32", "comment": "Malware payload (PureLogsStealer)", "value": "cf4f9bf36973f2de4fc7e243af62a6adf372b33366e6447832cf939cea9d0f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369035, "uuid": "3e13dab3-ff99-4575-b281-ff95227d0f89", "comment": "Malware payload (PureLogsStealer)", "value": "528936845edf27c418f66c82fbe9454b53655dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369035, "uuid": "afd307b8-3ff6-49f0-a639-ce4de7d0dade", "comment": "Malware payload (PureLogsStealer)", "value": "7feaa6b7dce8918236e3bc821740249e380e13dad1f9650d924d2f2ca1fd14db1e0629c0bf186c62278245703e97354a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369035, "uuid": "4c437d09-5879-4425-bc4c-c38dea5de2e6", "value": "T1CD75D005A3E416B4D23BD638CAA68733EAB678450770ADCF1355D6192F33AD06B3B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369035, "uuid": "3e11a2bb-0a31-412e-a246-f02677561fce", "value": "b10fe6479fabfb193ccc36fc8bef56cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369035, "uuid": "3c5187a4-bed2-4320-8c01-159dbc841112", "value": "49152:mBx5U/Kvh3+RNYN16yVJDdJfmfARoWCM+2W:cUyzWyXDfufQC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369035, "uuid": "6efedbf8-f2ad-4a05-aea0-aa2a5c5c1bbb", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369035, "uuid": "8cf1c52b-1b8b-4cef-94ec-54140b3f5e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369035, "uuid": "2dcd7b79-b6da-49c4-bfae-a73512b8a3d9", "value": "cf4f9bf36973f2de4fc7e243af62a6adf372b33366e6447832cf939cea9d0f4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81587919-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383597, "uuid": "73d05aa3-e1f8-41e8-82aa-d933266c0ddd", "comment": "Malware payload (Mirai)", "value": "47ed97ed6c383fad49ee94365345dd5f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383597, "uuid": "3fb86523-c526-4c81-a88d-b01e02335ff1", "comment": "Malware payload (Mirai)", "value": "cfc832390a1ebd9dfd21393e1173b4f6a812db7f3662f51c7a2109e8d7d478c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383597, "uuid": "b36f905d-661e-402c-b5cf-30250d7d3bf6", "comment": "Malware payload (Mirai)", "value": "461cbb7d748739b79b80686856687b5b0522ffce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383597, "uuid": "a186c579-9da5-4fa3-b7c5-6aa67acb1f45", "comment": "Malware payload (Mirai)", "value": "05c9d083aca5bc7788580d0e40fdc1b1f987f9c068def4e89728e358972e8a59d2bb6ea391f42a38920cdb34b7a88930", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383597, "uuid": "d5d80fc5-7167-4c48-a6e2-7bfc3a0c15d6", "value": "T18C33F26B0533C1F4C825E5324AAAAE98F859AC1BB6592D5A4DDF3DDF2DF1160C361D00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383597, "uuid": "118c7b33-752d-4e47-9a42-8c8cc1f5b5b9", "value": "768:z5CrX0hm9+Ad2GuuaxYVkmrP2/z6+uVpxQ3flqcWzjfKu+7Pc1ZY9zn+c4z:z5CL0hQ+oYx4HUvuJQ3tq3nEPc1ZYoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383597, "uuid": "7c39155a-af53-4c32-8237-14b5fbb8a152", "value": 55008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383597, "uuid": "e9cde683-438e-4c2a-87e4-2ae56b5e86e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383597, "uuid": "e6a4063f-f14f-4e02-b4c9-8ab3b3e3a15d", "value": "killbotx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7926f1b-94f1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786390211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390211, "uuid": "0c940c82-3380-483c-8146-dfc9f1219812", "comment": "Malware payload", "value": "6a44d7ba3895480f34673bbb67b8a6bf", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390211, "uuid": "d8b71b8b-80bd-495e-8a64-8bfb9c7dadc4", "comment": "Malware payload", "value": "d025d6a999d7691d903056414ba18932b3fd01718ddc0812942dd236155b7a32", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390211, "uuid": "9d9fd48c-f354-4ea2-a780-65c28c01320b", "comment": "Malware payload", "value": "b1a7dc387701dd52ba0688bd2bb10b1e138a2737", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390211, "uuid": "eaa96b95-26c3-4d4f-9b81-c993cae2dc15", "comment": "Malware payload", "value": "5b1eea376f314c86317418624618125abb595530fd7167822d1e98c93366033cbb95f7c8067e4ac7b3d60f1f30f38e49", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390211, "uuid": "95c408d7-fb8d-421b-b453-a78ea2fe24cf", "value": "T19EB5331A2E99DB276FF0E037B63C2420FCD13B79927C48A1B2D6E975E4994E50D6C0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390211, "uuid": "919c1ac9-c5e0-4749-a5d4-2d1eddd1b170", "value": "49152:yqCeyU99K8VJRNj6ujE+oGGOlAgmfFbJRDANf9wBL+0s3fXMltEYoTN627W/:yqbBX3Dw+oWl9m3RMNVwjsPGITN6qW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390211, "uuid": "c7219ee7-f334-46c3-814d-7b69571e671e", "value": 2482176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390211, "uuid": "5deeec9c-13d0-4518-ae68-257ae2743068", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390211, "uuid": "bb8e7fc7-63ad-44c6-ae5c-bb7f828ef031", "value": "d025d6a999d7691d903056414ba18932b3fd01718ddc0812942dd236155b7a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe47403b-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372640, "uuid": "44451dc2-8295-47ea-9250-016914abf158", "comment": "Malware payload (AgentTesla)", "value": "879755f6241bd455df7d06af9c8ba720", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372640, "uuid": "07c6d146-b4bd-4540-b45a-7110ffeb3c10", "comment": "Malware payload (AgentTesla)", "value": "d027dcc4aeb650adbe3fff5c124a96cd09d6d2c3eb602f74dc547dee735279fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372640, "uuid": "9466f57e-663f-465b-8584-bf4f0be2f205", "comment": "Malware payload (AgentTesla)", "value": "1817cefed6bd7399fc73bae311eaac0ee7089be6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372640, "uuid": "281a1c88-ff04-40e5-adb9-2e46943c8c5c", "comment": "Malware payload (AgentTesla)", "value": "1d2f45e2ae758491932b391854f61e4519140f65affbc38dd773655ff6b50d9cd199637be56a012d853bbe141401a7f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372640, "uuid": "281e3861-f180-4a8e-a0c0-8ef43537e498", "value": "T1644501801255D845E0D68BB5BEA0E63837A55DDF39C1C2AB2FE93FFB75B97830044262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372640, "uuid": "d1519091-9717-466a-967d-1a71f76a5df2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372640, "uuid": "cacd44fe-7927-4371-92a7-9220bf1cf4b3", "value": "24576:Ap50aXhTPc8plqc8TEtGCp2Igp4G1oRybl82s0O8BD48rWHFDW+1RUr:AplhVUcfp2cG1ML0O8BD48rWHFDW+1Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372640, "uuid": "809d600c-2405-42ff-bacc-50c8dc13889c", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372640, "uuid": "793531be-6637-408a-8572-ce34a1ee08be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372640, "uuid": "9df96d98-b650-409a-8ae0-8cc1ca34a4da", "value": "d027dcc4aeb650adbe3fff5c124a96cd09d6d2c3eb602f74dc547dee735279fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98da47ff-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383637, "uuid": "3a171aa4-6a57-4b99-ab28-cab044514420", "comment": "Malware payload (Mirai)", "value": "5625196702d438023dbff7f774dd2b6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383637, "uuid": "e2a21fca-26cc-4698-af3a-079459f72434", "comment": "Malware payload (Mirai)", "value": "d03d00585eaba168f6c1b4862a8a40cfdf4a686b99763571b940a542a3aad947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383637, "uuid": "b4c85e58-1dbc-4778-9240-c25835330b80", "comment": "Malware payload (Mirai)", "value": "7eac89479359231b4dd832d3ee67f392a4c306bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383637, "uuid": "58925078-a15b-435e-b46c-16af8bd35f96", "comment": "Malware payload (Mirai)", "value": "769eea54645bce9c1d90510362ddfeb07505da63ef426d4c5a2298bdb2eee0a511cb820a43dfd7e4c407202395f72a9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383637, "uuid": "f78a19da-09f1-4a8c-878b-1255aef5097a", "value": "T174F38EA8DA0FAD82D6C3F7BDAD594F61303338B84664C1B34D0056ADD5EBED598E2422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383637, "uuid": "577a2d44-0753-49d6-9276-a6d6f66df13d", "value": "3072:QAEE3he+/ovP8O8wputyVxCgt5GC/jr3HxxDFG8FLK+7:zF30PP8w40VxDt5GarBXG8Ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383637, "uuid": "e86258fe-0012-4b5f-b1a2-9ce581aba7cf", "value": 165696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383637, "uuid": "4c3f235b-75ac-4375-9e16-005b2a9d7561", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383637, "uuid": "81812b92-7274-407f-bd57-1c412463b10a", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6eaa97-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786373842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373842, "uuid": "8bf7fe32-f62b-4c70-9779-9a42fa9abd29", "comment": "Malware payload (Stealc)", "value": "5d6aaa76f1794af4ae4f458bea360e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373842, "uuid": "33d162aa-949e-453f-935f-51009ee5f788", "comment": "Malware payload (Stealc)", "value": "d05b0e10a2a8a24a4a60f8b737a5827393f92a55dbb647687f20e0614a641ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373842, "uuid": "d66d694f-aa20-4853-aa0b-0f8c9ab54773", "comment": "Malware payload (Stealc)", "value": "b4ee93ef56860505127c2419fd4e2c9abcd88563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373842, "uuid": "3a986a34-3b7c-4703-9891-dd056845d531", "comment": "Malware payload (Stealc)", "value": "d31fb5e6ff0e5e189ff4e5a097ae21113d7748806f767d136b8f6e342706f99e39c37e06a2a54a0449fde11c1078d621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373842, "uuid": "8a654cac-edc4-4780-b515-1fefa0739753", "value": "T1E7F59B07BCE588F5C09A923189B756A27B75BC090B3127EB2E6067783F327C09D36795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373842, "uuid": "6c0f400c-fb2e-449c-94b4-532e25367c70", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373842, "uuid": "14b16538-1314-469e-bdc7-a14600f8938e", "value": "49152:C/+Y/ld6OZlYB377Txc80NoReobHkJM8P7b4fPwvaxNzYIl4:Cl/u9X1E688okNzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373842, "uuid": "8663fd40-5717-438c-b663-0da6b61558ed", "value": 3560960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373842, "uuid": "bc177103-b8c7-404a-b7ba-b0d1c4b45351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373842, "uuid": "f75b0a0c-7889-431b-99ab-ad8d36699512", "value": "d05b0e10a2a8a24a4a60f8b737a5827393f92a55dbb647687f20e0614a641ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f65628f-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369313, "uuid": "4d3cc898-4ed1-4c94-9759-b665a8ba8db6", "comment": "Malware payload", "value": "cf0a9a3936138226f7bc82dc62b35019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369313, "uuid": "623bd11a-126f-4cb5-ab4a-a12a526ab850", "comment": "Malware payload", "value": "d066a39d8135ca2d2015735d8a756846df8c4e16ffb442b46db10ffe352dcf83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369313, "uuid": "f577d329-15aa-4707-8e75-846cbf6f5c04", "comment": "Malware payload", "value": "1c29ce772a3cde2d057cceb50406c6f924e6855d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369313, "uuid": "34f36216-3edd-4851-a1d6-66652ff09b22", "comment": "Malware payload", "value": "94b58c80c2e9f30b9a395edf406b4f36ebb69ae6fd70f0764dd45a5fee3d0b7b847231f3544ac578e9fbd061aeb598a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369313, "uuid": "ea872739-2726-4dcd-ae6e-0133a7b9236e", "value": "T1E835E1363A49AE0AF93F0BF6641BC17417F0EF552119D70E2FDA36A7A9D1794482B302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369313, "uuid": "b57e6818-e06c-45b1-9cfd-9b9912638c4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369313, "uuid": "4849a7e4-8f4a-4d52-9179-6e6b9dfe3795", "value": "24576:g13NJC5HPxaXyVIPOr+e4ggVqkXOIZxXOmf6:kO5JaCDygg1XOIvXOmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369313, "uuid": "09e1a292-3f6f-4081-ae6c-409e393e6d77", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369313, "uuid": "a0fab541-a470-4c8f-a18d-c43e29f7489b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369313, "uuid": "a58b61d5-2b2f-4a6a-bd8d-5ca1263c0759", "value": "d066a39d8135ca2d2015735d8a756846df8c4e16ffb442b46db10ffe352dcf83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f21eedf-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786370950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370950, "uuid": "6f32910e-4e88-4708-8762-acdaa5fec3cb", "comment": "Malware payload (AsyncRAT)", "value": "4cf6f56fb7c4682b1037cfef577a3a06", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370950, "uuid": "f350327b-a2e0-4b4a-a223-f6ae398e5549", "comment": "Malware payload (AsyncRAT)", "value": "d073fb2faae776d80e0cf2c5720da618295daca356a706382c02fb64f4b838ba", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370950, "uuid": "734b2c7c-1621-4418-8a3b-02c3ce8c52df", "comment": "Malware payload (AsyncRAT)", "value": "9b47019c2443829bd419f6713ff4ddd6b7d012a6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370950, "uuid": "734ec304-39d9-40c8-ae7d-a647409a3c73", "comment": "Malware payload (AsyncRAT)", "value": "fe9524f043007102cf9ea2c85f4337b57d91cc63ff3a7b417e910bf2169a46bb5542b46a46fcf6c208287798400598e3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370950, "uuid": "d6352241-142f-4e8a-bd77-83fd0a8fc6f8", "value": "T19B050114335ADC02C5D36FB11D70D37911B99E88B815E373DEFABCABB83E6866911281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370950, "uuid": "4a2924e1-e391-44e9-888a-84a80f3721fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370950, "uuid": "b41d2476-db3a-4d0f-83ae-633f4547aa5a", "value": "12288:9IAlxe0/fJ6L9FOdMpeRKrOaH91w4wpe8het/new+zm97vwACyh+:nzjR6pFsRKiqE4cOt/WzkwAh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370950, "uuid": "d76f7488-e2ee-48ad-a606-753b218ebb2b", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370950, "uuid": "5e9b3c80-0dfc-4836-92c6-ab2d68082470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370950, "uuid": "1c616b52-6a79-44b1-9ead-ab65bc7f8111", "value": "d073fb2faae776d80e0cf2c5720da618295daca356a706382c02fb64f4b838ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1160c824-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371813, "uuid": "61151fc5-aa69-48e5-a8ba-edce944d3177", "comment": "Malware payload (Vidar)", "value": "032f17f03a5ec49617231400331853e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371813, "uuid": "1f3b44c2-9e98-4f41-8bc3-530a3875884d", "comment": "Malware payload (Vidar)", "value": "d0c95fb4cf1406a1d659821d02e18ca6f55694c7d295aa4fffa0fa71ac768b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371813, "uuid": "c09665b8-b0d3-4701-bf08-9e08899208f5", "comment": "Malware payload (Vidar)", "value": "2d3a6f2eaf187ae033bfc378ac7210bd4a8b3670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371813, "uuid": "cf5c7fa3-f635-4398-badd-789f364776f8", "comment": "Malware payload (Vidar)", "value": "6bacd1b65dda254b2a33b10be1aa2badf0507c13d4853cf606744baedbd9e9bba82819c0ad5a9798f43e60087f3d3180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371813, "uuid": "891c8e38-f742-4a02-983c-5999ced7b4a0", "value": "T1945239D270A3A2F9D06DC234DA4626FBC5793051032B9EFF42DC96A53BD115169F8BC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371813, "uuid": "4990059d-0e0a-422d-9a2c-156b7c59bfce", "value": "cbca86e3728e81cd2d5b03d7adb2cad5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371813, "uuid": "9046b8b7-de36-4c63-9165-49958a07cb7f", "value": "192:zKpAa17IXAwg3HYx6Vo2yUQEnrRB4IaoHa8FturjsD3Vw+f:O7flXs6Vo2y0rRjX5YkDlw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371813, "uuid": "1a49bce3-edaa-4dbc-b58c-fb5fd035c6bb", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371813, "uuid": "64ad0373-13d0-44eb-91db-f45f178acfc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371813, "uuid": "503bbfdf-f7b0-4a42-a338-7aeb2217a48f", "value": "d0c95fb4cf1406a1d659821d02e18ca6f55694c7d295aa4fffa0fa71ac768b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5e5697-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368768, "uuid": "a4ce29bf-4d69-4614-ad50-7302c44ed456", "comment": "Malware payload (RemcosRAT)", "value": "b1c834cd5dcc4e942eb46c874df53752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368768, "uuid": "0bcee714-066d-4f53-9a81-3cfade9c6c75", "comment": "Malware payload (RemcosRAT)", "value": "d0ff391430324299558df195411ca64cfd19e235aa3df5e76732571d7fcb2210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368768, "uuid": "cea854cb-8bc5-4a26-9ccd-91fcd9b1c018", "comment": "Malware payload (RemcosRAT)", "value": "a24704dbf86bc665991af9b00a18c55ef09d5b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368768, "uuid": "32248f9a-71a8-409f-9fb3-1445e13818ce", "comment": "Malware payload (RemcosRAT)", "value": "529909d433202542bfab962c8cac99e128dc35445d44d33880f98475abb6293bcac1317c137328a4bddab9b33a19c4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368768, "uuid": "32da8283-b3cf-419f-8fc3-1a973ee0a0ad", "value": "T1B14522C4AAE8CB12E5FA4BB12AB5E33143B53C4EA911D71A2EDE9CEB7434B414314753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368768, "uuid": "a7ece483-922e-4a33-b04d-627e1d7bdb5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368768, "uuid": "971f01c5-11ea-4e4f-96e3-9fbce6467788", "value": "24576:st/zkhaSsAwZF0Q9w8jsGza6A0kcI7ESqDdjqeHOQ4:sRquA2/9poGnA0kT7E1Dd7OQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368768, "uuid": "b9383666-b018-47dd-9d20-9ccd0ab0c17c", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368768, "uuid": "d9aa80b2-e31e-4ddc-b0cd-4a61b03c2aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368768, "uuid": "71924c0f-9174-47d8-8a13-3dfbd9367a4d", "value": "d0ff391430324299558df195411ca64cfd19e235aa3df5e76732571d7fcb2210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b911a3ce-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372524, "uuid": "eaa87a64-227b-42db-a066-323f09eeb0b1", "comment": "Malware payload (Formbook)", "value": "38db56173a7bf1377db36da7120c25f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372524, "uuid": "3c39dfc1-6127-45be-b9e0-5fa19aae7f12", "comment": "Malware payload (Formbook)", "value": "d136807c306c62ca7cb75f732169d4f27dd6596d66f877c265372b46666bec3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372524, "uuid": "2ba78807-6099-4dce-9549-4b2a88468e3c", "comment": "Malware payload (Formbook)", "value": "13ed4468a620bb57384584cc7853ed7e79b83607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372524, "uuid": "61f21b8a-0484-4431-b722-e98833b2136d", "comment": "Malware payload (Formbook)", "value": "c3516e93c218f5c5e055365723aad2f43044fd7d6ad996ed7ef2122376d7c96bce0af9018e323f57736e264883a04e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372524, "uuid": "ca7560c1-3936-4083-a812-42a568368a0d", "value": "T19C251290B3E9DB16C2B887B51D72E03007B96C2E9424D3564DE9ECEBB534B149E60B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372524, "uuid": "d377f6ff-2ad3-473a-9273-0d48c707e115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372524, "uuid": "296d0563-7f84-4839-8509-0a41c613b633", "value": "24576:8+j/Og3Ru3hMluaC7DTJdSqhjKvcsUZMm4GiE0J4zgClyDA/:JPhQMlBC/ddS4jKvLs4GiE+pcMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372524, "uuid": "2c7bf74d-3b92-4e7e-b959-5e8bbb92a9f4", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372524, "uuid": "9aa362b3-c5cf-4bda-a8d0-7b7aba7f5234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372524, "uuid": "09b663b2-f253-4654-a9ec-139e350b133c", "value": "d136807c306c62ca7cb75f732169d4f27dd6596d66f877c265372b46666bec3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640551cb-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368945, "uuid": "ef4c18c2-3a95-46fd-899c-324112623949", "comment": "Malware payload (Formbook)", "value": "9c28ef824a84efc077b3a91d4d902fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368945, "uuid": "f86fd95b-90e5-4f71-bddf-1c5c751ed8ae", "comment": "Malware payload (Formbook)", "value": "d1e15b02c12d3cff9d28bc6d0dd52a264bf5750a69ed2ef51f4b8a863bd08597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368945, "uuid": "8f954a3a-152a-43ca-b6cf-311e8d130c63", "comment": "Malware payload (Formbook)", "value": "d64c3f9382ecfc4fe32314fbaf9c25ca24fb8be6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368945, "uuid": "fc9b36fa-0258-459a-9592-fe3815dc8b50", "comment": "Malware payload (Formbook)", "value": "55d3e53d62e8b27e4f3d07a8131c383a1e89d9995e1f3739474bb63acc4d6232285fe79b7477cd79846a836c3a41c162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368945, "uuid": "efb2edd5-d684-48ad-9267-d088e678826d", "value": "T17B351219125ED903D0A24FB90E75D3B867B46ECCA522C203CFD9BD9FFABB6A15840351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368945, "uuid": "7f457d91-2ced-4c30-9acd-919bdae858bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368945, "uuid": "01903d12-4031-4adb-a1b3-29921668b0c5", "value": "24576:sa6Uw9Rw5uqpSvFZt+BZeo9voZdZIsmpdklf2sZ:sa6945uqsvFf+BZeo3Vw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368945, "uuid": "317beaa5-10d1-4353-b394-84133f19e6f2", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368945, "uuid": "6a3b91e1-cf8b-492e-972b-9f77be600119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368945, "uuid": "c20c4964-21db-4ff6-b53f-f88f79fc65cc", "value": "d1e15b02c12d3cff9d28bc6d0dd52a264bf5750a69ed2ef51f4b8a863bd08597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1827bb-9492-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786349039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349039, "uuid": "3faa2ad6-44ad-4547-ba11-633672d0e313", "comment": "Malware payload (Formbook)", "value": "0ee0f73bc65991c20240160a65951370", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349039, "uuid": "21e1d9e5-e1f1-4ac0-b154-f722e73fc747", "comment": "Malware payload (Formbook)", "value": "d20de63c153327fdaef5073fd50edb815da7a908321da9f1f8edaba662b4b563", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349039, "uuid": "ac83eb2b-05ee-494d-95d0-746c18b504c4", "comment": "Malware payload (Formbook)", "value": "bd0dc2a470c225d487df5d1c27d61bc16b25225e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349039, "uuid": "3c7f753e-49e1-4969-98bc-21114c85a971", "comment": "Malware payload (Formbook)", "value": "f2c3faa1c0b85c0eccb8d90264cf5f5c37ae8ef58e3cf058a0fe1d6235e9653d6ffe39406a2d727a0b9938df7a057a63", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349039, "uuid": "0dc5f6c2-187f-43a4-8eeb-5c7beceb9f26", "value": "T1AEE5F6412799AD337320AB9C923ADDF0D50A561314C6DF1631ADF2187B2CD4BAB58AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349039, "uuid": "fcddef54-23f1-4b12-85f7-d4c7e32377d9", "value": "98304:HEesTszC/ZbS2hY0rdqv+vZSPFNkVboZLkrj6HIpMIElRJ5MloHw3KC6QcUvOUuF:VMVRO2hfYlNQ8ZYrOiMIErJkoHw6rQcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349039, "uuid": "b1aaf5eb-ff26-4626-8edb-7307602a9206", "value": 3150702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349039, "uuid": "2a147d49-c5bc-4606-a60c-ca9a48e1b165", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349039, "uuid": "0e4ba0f8-8bc5-4ac3-9622-82824cb7ca8c", "value": "invoice payment.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3baaf31-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346369, "uuid": "9673d978-b347-406c-be3a-17ce5fa070db", "comment": "Malware payload", "value": "7c30b3fb64224cff9c85a3883ab807bc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346369, "uuid": "bd379c4d-2dce-4b65-8663-4666abe1ce4c", "comment": "Malware payload", "value": "d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346369, "uuid": "d50ba641-f5c9-4403-a8c5-a7aa5da7f9f2", "comment": "Malware payload", "value": "c1debc1c4ab3753e25532975d52db3ae4a2d175c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346369, "uuid": "763e069e-ddb7-40ae-9cf8-752126d3950c", "comment": "Malware payload", "value": "4751d99e5de5e32709bf77a573625776ef236f2f38d85823790a60fb8897210b1ea88190833cf6d83ebb06c9d0eea4fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346369, "uuid": "89a75e43-2172-40b5-b078-fcb3bd6aa593", "value": "T163C27D966A867C44BDC98A3E4CBD2B0D6DF5C3D1324942AC3D9A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346369, "uuid": "c2bf2e12-e3ae-4976-a1b3-d6c55a8928fb", "value": "768:18vCB+25j6es8Rrq9FYpMSUpi+20qUpi+20YQX:18l25J4d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346369, "uuid": "e5da27f2-902d-47c4-a67a-40e723ec24c6", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346369, "uuid": "47a180f8-d29e-46b0-8655-3904c9fe174e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346369, "uuid": "02c84c1e-a519-4f4f-bbf0-f22cbde831be", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f05bd46-948e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786347516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347516, "uuid": "8638f0aa-21a8-49da-85eb-3d85f77f9875", "comment": "Malware payload", "value": "71a9927d265b461b339c3f5e1d104d2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347516, "uuid": "174921af-7ee9-4cea-83cb-c15880f54637", "comment": "Malware payload", "value": "d25fe7454edf44845529af291bda936e4e3d411a3ef200d4d2b2a19191358271", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347516, "uuid": "48b46a30-41f2-4a33-bd89-0020823f11d4", "comment": "Malware payload", "value": "87f39c24468b0c3b0eb31ae614c6d42002a1754f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347516, "uuid": "ca37a01d-b315-45b6-b2a9-0d9cb21c9afd", "comment": "Malware payload", "value": "1261d92fbe2b9b083dc2187dec0e8567c03ebf4591fed0976e505544c2735b9e5f1f4ce98793b56c400f0b69f122eeb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347516, "uuid": "fe9acf2b-4f73-4b49-97c5-0d8acf77ab91", "value": "T16E23F76727630D23C0D6517592E34332B6FAEB4A28B88A577960AFDD1F485E032533F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347516, "uuid": "9d4fcdd6-234c-4bfb-94ff-f8f911e558eb", "value": "768:hewE1utthJvfY4mzKUGtO+poBfm3utu6pRST:bY4CKtqO3utu6bST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347516, "uuid": "5a3a344d-ab4d-467f-9f9f-2af277dfd166", "value": 49044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347516, "uuid": "e942bc74-fd89-4041-b1e0-b5070237d3ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347516, "uuid": "c9041582-42ec-4278-90bc-0970a72a9a07", "value": "main.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff5a091-9494-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786350041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350041, "uuid": "1c8cc76e-eda2-494f-9159-86a679e905f8", "comment": "Malware payload", "value": "02fe1bb8f95a2d7d5c0e2bfd6da90576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350041, "uuid": "08ff95e7-6e2d-4a51-a0a6-9747f55ba62f", "comment": "Malware payload", "value": "d274113fd9270f0eeab5980c0e3e629e09695ba3ac35bc5e30771cda7cfe6b6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350041, "uuid": "7e0a1eaf-5d3d-4bcc-867c-3a16f7e8e31c", "comment": "Malware payload", "value": "ab16b46695f648c146f8aaa8132c26f0b1ecf485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350041, "uuid": "a9f1ba45-4f6c-497e-bb29-f16b2a1d1dd4", "comment": "Malware payload", "value": "2154260cc5ffbc0b59f177d7523a5afc82d33037e21ec2a7b2ecb9e5a768e62f9b14fba26f63e1fd37cae17a556d971c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350041, "uuid": "004c0c3c-a646-4fef-bf4d-4fa0caf1ce23", "value": "T13923F8912BC955ECD973C2F4EADA12B3E5E67011133299EF9BA1CC005F216D2F539A0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350041, "uuid": "f5ffb168-848c-4463-b904-821e809f884b", "value": "bd789847235ace49bec120e89d37fa42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350041, "uuid": "d9d6d488-abe0-4fde-ac83-a6f1cd412cab", "value": "768:++q3RB6sO7RiE8JKHOvjCfxt4uSYORn03VJa4Zs4lxstV8GwEaUTODkoA0qUpg:Hq3RXq98JKzffDlORnR4zC8GwEaE2yU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350041, "uuid": "06cfb716-0d7d-4bdd-a681-d639f4b606fd", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350041, "uuid": "a4744f26-6ff5-41a2-81fa-a3d3c0f3b307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350041, "uuid": "d9b8ef40-9a8f-442d-a4db-9506bc20ea88", "value": "02fe1bb8f95a2d7d5c0e2bfd6da90576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d553c2f2-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339930, "uuid": "60b478a0-aa38-4531-ab43-dfdbf1c829c9", "comment": "Malware payload (Mirai)", "value": "3f1bbf952124a8e4cc0cfbd9b46ffb03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339930, "uuid": "92944481-5107-4612-8c67-df25e95eced3", "comment": "Malware payload (Mirai)", "value": "d274f1fdb1724f34b82bd78c0d723199259f11dec1a8e20696e3ea977245fe3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339930, "uuid": "d2f33ae1-8e8e-4359-abc2-45afeab07a90", "comment": "Malware payload (Mirai)", "value": "67330f7d4a4f6ad5a83f31c4f1ac2c0197fa3b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339930, "uuid": "93beb03b-f69e-4ef5-99ab-829ac6590293", "comment": "Malware payload (Mirai)", "value": "a0ff13701e0be699e94131fc90e95ff232df562e6ad7c10a9b74bbca7fba2b452f03fccb51f67736dc27fa7c8f69b273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339930, "uuid": "f50b3c81-9b5e-4a93-8263-c4b51b6a6a2e", "value": "T185A42A8876E0EBDFD05CDF70832EED1718A1016270D3715AB15DDBEB27762450AABDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339930, "uuid": "4cc2f562-20df-4334-bfdc-f9b9972bff7c", "value": "6144:wa9Ea9pa9f0buRLxiCilSrk1Tvy/gpyj06aA84/HPgVbrbT:wa9Ea9pa9f06tx/i91T2gL4/PgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339930, "uuid": "a8e176d0-d2a9-4d04-b6d2-ba6f16d88f7f", "value": 459248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339930, "uuid": "22a1d34c-b0c9-48e5-a153-a0f9c8a13a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339930, "uuid": "a775a873-a053-4784-b735-a16b10f34872", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d3f89d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373436, "uuid": "2c458a42-a4d8-4eea-83b1-f31a7bb20c8d", "comment": "Malware payload (Formbook)", "value": "41a08f64987bf75c4791a1a9318d169a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373436, "uuid": "b34f8121-2a19-4aa5-905c-153259accbe0", "comment": "Malware payload (Formbook)", "value": "d2910ae06e748f283a4ecc4826a4ae03f9c4d52bcabdf5a9053a7e1f4536533f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373436, "uuid": "78865e05-4a70-4c88-addf-be891d14deac", "comment": "Malware payload (Formbook)", "value": "0e4f71158b79df9321b20e631a26031e0e41218d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373436, "uuid": "491d7ca5-7ecc-42e0-8131-982ed0e1efc4", "comment": "Malware payload (Formbook)", "value": "a2ac461891fd45ee309487dda308dfc45991f1947d9ecbd084c41f8077077e6094d97d606e186db2a7d6a29416cd77e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373436, "uuid": "84162874-1436-4f98-aa38-2a51e9f00579", "value": "T15B35F1581356E982D1D68BF6BDB0E33032644DDF7AE2C3929FE96FE774287C04954282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373436, "uuid": "c153a4ac-7ebf-4cdf-8fc1-28041c96dbe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373436, "uuid": "8a9a9be6-94eb-40c1-afce-ea68916facee", "value": "24576:4SM6p50ttZawxme4qW4SUOVkNwtp/9CRPUrnbBBsK03V+TYuv:4wpkL74qAU+MGNntBsHV+TY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373436, "uuid": "61eaadf3-7ba8-4789-a637-02e2ef4658e5", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373436, "uuid": "e6e9e191-82bd-4c66-a3ee-02c4eaca5736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373436, "uuid": "69d0f4d2-84b6-4b2b-8215-d9b2783264ec", "value": "d2910ae06e748f283a4ecc4826a4ae03f9c4d52bcabdf5a9053a7e1f4536533f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873165fe-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371152, "uuid": "01fadef0-d46a-43ce-927b-a58101e7def8", "comment": "Malware payload (Vidar)", "value": "dad1836f2dc43fc8930678ba76410357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371152, "uuid": "b2451f13-dbd7-4db6-a903-d1d4652edc39", "comment": "Malware payload (Vidar)", "value": "d294e3a621a03ea8342a42cbb1a863a879d5bfe6c2528b34a1ce5e960505f640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371152, "uuid": "61ad070b-38e8-416e-9ac4-50bfb43acec9", "comment": "Malware payload (Vidar)", "value": "782087ccc3c708d85e4802402e9c7b9cada849b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371152, "uuid": "22b85e66-d93a-4a9c-90bf-062b300d9777", "comment": "Malware payload (Vidar)", "value": "49eaa8a315c82f031ddf479b4c792b26c05029b29366696cd9d4eaf6865a3e468eefef10ae678509fbbc76e06194a362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371152, "uuid": "78cc8fea-72f4-442d-aba7-5ead044e6e0c", "value": "T1F7822D46E11762B4C4EBC337A367462769F8BC4031326B3B6BD85A714E52330E7282ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371152, "uuid": "f1240a41-f61d-4546-ad52-1da91fb09e49", "value": "b5e9e2156ca520449c28d291e1d33927", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371152, "uuid": "7ac564cc-137f-4fa7-88e8-ac9aa8879660", "value": "384:OZh2YXmQj5Ia/dxbmJAsd17rggu1Qn1HFPZsh8xyRwy7+RtNE1XRlduS:sh2mIGKm8xqwHDNYgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371152, "uuid": "e19c499f-5e73-4ea0-a0b2-e800c8738e60", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371152, "uuid": "c09002a5-2eed-40c6-9907-7725b6ea5eb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371152, "uuid": "d20781cc-0aa0-408e-a6e4-6d73ebc617db", "value": "d294e3a621a03ea8342a42cbb1a863a879d5bfe6c2528b34a1ce5e960505f640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d360863b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371709, "uuid": "a0b7342c-785a-4dd5-8e79-edcf0e9bdc66", "comment": "Malware payload (Vidar)", "value": "b5a4015e541105b0f0d752b632ee6831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371709, "uuid": "6d400ff4-a38e-4f31-9def-9ad85a70a06f", "comment": "Malware payload (Vidar)", "value": "d3ad714cc5b3b5675f86c62d84e17d7d1b753aea9f7280fdbb9cbc4457d90ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371709, "uuid": "ffc22b8d-b413-4006-a266-f91ec99527d5", "comment": "Malware payload (Vidar)", "value": "1e8dbdc10c2fbbcdfa41fe6fe67efa43b7212d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371709, "uuid": "0a0efe15-fd4b-4176-b2b9-0d92886c0c7f", "comment": "Malware payload (Vidar)", "value": "049c82e707bddf5d9ef8145a2238407c8f96a10a028313c2cf3a93936b64e3dbf9f31ab1307b3f9e2dfffb254c41902f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371709, "uuid": "c8140857-caf5-4eb1-b134-1119f8c109b7", "value": "T1E9420ADAB383B5F8D16AC2BC8D5B17A6C3523089131E1AFF48E9CA9837C75117274668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371709, "uuid": "d42251b6-6639-413a-b6b8-690400124eb0", "value": "d75ba585eba136b8bb405d3a97b34027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371709, "uuid": "bb2c75a9-662b-46d8-847b-5edd3458ff49", "value": "192:OnQomodk7GgK8mDDhsnKzanLzBpHHWSMYq9lAm7NDBpZ4wa03VEEVCwl8KMTk:OJzOmD1yjnL1pH9NSlAmRBvVlEEVCwle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371709, "uuid": "26037342-1b4f-4b54-8183-7ff95512d76e", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371709, "uuid": "38b3f3ba-bc0a-4d83-9ede-0b1ea00cb85c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371709, "uuid": "60a7e0c9-439c-46a0-a55b-6f36922338f9", "value": "d3ad714cc5b3b5675f86c62d84e17d7d1b753aea9f7280fdbb9cbc4457d90ca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9aa87f-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371889, "uuid": "c1b3ea58-b381-46c9-b9d5-aeae0cc9b1be", "comment": "Malware payload (AgentTesla)", "value": "9b1da214700744d7945643cf5fc6a50e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371889, "uuid": "24eba30b-d7ab-40b9-a49c-044b17be469a", "comment": "Malware payload (AgentTesla)", "value": "d3b273fa6c2d5246a812f39c8d77da537a0eab060bbaab558a67834af4c4fecd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371889, "uuid": "1d6a57c7-a09d-40c7-9e05-8692696785e1", "comment": "Malware payload (AgentTesla)", "value": "091c6293116e92a2ce35b779a831a08ecb157839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371889, "uuid": "4df79b30-94b3-4e31-be95-c2dfb532c28c", "comment": "Malware payload (AgentTesla)", "value": "d8addbc3028bbf587f9cfca05b08e3cf242bef0c7191f8719de336e20e5121ac3f48ab3dff7b8fc56259f18b713c6c60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371889, "uuid": "ca5f0360-e999-4ed8-802a-8f3b0f193039", "value": "T1F054F111B780C5B7D83E06708A37C6711BB6ADB116F26B9B3354772D5C32292DE0FA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371889, "uuid": "f59f0c38-c2d9-48d8-b407-9b49b4c992d6", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371889, "uuid": "d8ce80a5-fa95-429a-a318-365762ff45d2", "value": "6144:6HadpdwMGEzAvSqeOb599d3rjSkAa8Bab7aKAU:6HaduEzAvSns99RrjS+2QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371889, "uuid": "4531c1fa-0202-4699-9c23-0f77cd835cc1", "value": 286280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371889, "uuid": "33d0f711-0dca-4133-99b6-d545f61de035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371889, "uuid": "3f698b53-6d36-47c4-a2f0-b75789e99242", "value": "d3b273fa6c2d5246a812f39c8d77da537a0eab060bbaab558a67834af4c4fecd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b11fbb0-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786343187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343187, "uuid": "abdb9fcc-96f1-4456-9f33-d05694db5c07", "comment": "Malware payload (Mirai)", "value": "d290112aba2f6331119463f5b5f575cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343187, "uuid": "902c3477-eb0c-4a20-b912-30f1dae1eddc", "comment": "Malware payload (Mirai)", "value": "d3b7f99f3d24b21c119e5fdb4114e2fcc9c044569ad8bb2b030bce09152a9d51", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343187, "uuid": "1302706f-1564-44ce-a27e-062b31da88c9", "comment": "Malware payload (Mirai)", "value": "90ade09c30fdd313130b98adca60cff2a5125385", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343187, "uuid": "cf202669-0bef-4dbd-9ae1-2f25bacabfe5", "comment": "Malware payload (Mirai)", "value": "ea2d5cd7371b4c230681ec6b4960fdadd83ffca869dfc26a0c4ef0dfeb877ae7a898ff49e9ae96052a19593ebfe20fa8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343187, "uuid": "a1626fc9-c27b-4cb6-a0ff-fda5eaf16350", "value": "T127A1BF8A2478D63CA47FD9AC79E54B40988D45E232B23F399EB028535CC9970B349F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343187, "uuid": "4fae9df8-120b-4253-a475-6f5c02ad0e8e", "value": "96:jl/8HvLiPLxF6eAN3xodPYjLy+6Fnh4iQ/dtSbBmLoTQ//iVXrINFL4Nxuxfdc5D:jl/8HvLiPLxF6eAN3xodPYjLy+6Fnh4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343187, "uuid": "75beaa3c-dd52-44f8-8ae2-9e56a359371e", "value": 4893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343187, "uuid": "f3575f5c-23f4-4fa4-8cfa-1f9f268fd884", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343187, "uuid": "a840f52f-6365-49d9-af96-83de12d574da", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5323a470-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786372782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372782, "uuid": "38a8e140-5ae1-4e11-b409-4a25e3720a57", "comment": "Malware payload (DarkTortilla)", "value": "731311b8287f64f13db2d496b788c5e3", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372782, "uuid": "374713a6-bd6f-4846-84d2-e88ccea1d3b8", "comment": "Malware payload (DarkTortilla)", "value": "d3c74b01d12cbb78f8ec5368745a3931891ef2ef5b63f97cd3c4cf2a2ff4b2f6", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372782, "uuid": "30dd124a-5fc4-415b-b6dc-b93815113605", "comment": "Malware payload (DarkTortilla)", "value": "e95aca4e0b5e57b938ee920d55a9cf61396fba29", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372782, "uuid": "ee34d842-38c8-46b1-8303-22e40f0c1396", "comment": "Malware payload (DarkTortilla)", "value": "0ba907215e5061510dde726414e272da9eaf219bba8338cc4e086aee2404338444f63a88e2d46702f94617d78edbbffd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372782, "uuid": "a60b1585-6a04-4f37-bb24-fa059b513a8f", "value": "T1AA75DF45DC822690CD289B709277C87453B2ADAF2574E62E19DC3DF37FB7783A822452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372782, "uuid": "670b3002-4f55-455a-b669-50b20ce3ac22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372782, "uuid": "c09724b0-64ef-4cdb-8abc-1adf24dd3c39", "value": "24576:XzrOF8HKLZ4e2sAh8cYH+frYEzRDtMfLhLKR91q:DK2HKtH2t2cYef0+RxuWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372782, "uuid": "99733499-6a06-4d72-84d5-4201fed65b3d", "value": 1573888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372782, "uuid": "0d1126f7-0fc4-4ca8-9cac-97f2a36c4cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372782, "uuid": "d42093cb-0262-481a-9f53-b1ae72521af3", "value": "d3c74b01d12cbb78f8ec5368745a3931891ef2ef5b63f97cd3c4cf2a2ff4b2f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80541005-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373288, "uuid": "9b70f5c7-77cf-465a-a412-352e26f42c19", "comment": "Malware payload (PureLogsStealer)", "value": "455e99db36c9e58bf004c645e440c645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373288, "uuid": "fac5fe53-d9ed-42db-bfd1-56991c96626c", "comment": "Malware payload (PureLogsStealer)", "value": "d4101a743090d698917c923881e47a9d62295378ffba882fd21d5dad06c4b17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373288, "uuid": "06ca624d-2d02-4e21-a82c-0e598b50012d", "comment": "Malware payload (PureLogsStealer)", "value": "5a187dd7820d12cc52e0de7f908297e9a4d8349b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373288, "uuid": "de831773-c4ac-4be6-8f5d-51ec9925f13e", "comment": "Malware payload (PureLogsStealer)", "value": "8ecb00771becf308036fa2fc463706bfdf30e885649aa68977916906662bd9d2474e3bc6c96a1402055b16e232581a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373288, "uuid": "49eeb3ee-4f78-4525-a17a-977e0670bc77", "value": "T1087512081206DA42E4E687F6BC60E37933B50EDFB4E6C2966FF56FF7742A3401658681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373288, "uuid": "4fe2d885-4462-4254-be43-67c1dab24679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373288, "uuid": "a7a58325-3365-4fe1-b8d4-c4ff63511cc2", "value": "24576:Fp50g9qh8wUnmZkA+NlVtx3HXI1zEXkAnuI9EoB6uM4E80hXLvzBis3Nr:FpEOhnmc3nY1zEUTIqhXBisd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373288, "uuid": "86cf33ad-d465-4365-8871-028a5672534c", "value": 1674240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373288, "uuid": "d29ca03c-d332-44d2-b447-7bb2d3c58a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373288, "uuid": "a3de6e50-006e-458a-b4f4-1fcc105fb530", "value": "d4101a743090d698917c923881e47a9d62295378ffba882fd21d5dad06c4b17e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0f27f7-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395051, "uuid": "0bfbad03-d17e-4020-99cd-a6f1cdf1a822", "comment": "Malware payload", "value": "c2ace62fafcea5a25962c403ba30d93e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395051, "uuid": "6c4ae92c-2f44-4227-bf9e-062573565015", "comment": "Malware payload", "value": "d45508a746316e39b5ad796252913344b9e005ca22bfb511ccb8ca8114689f27", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395051, "uuid": "f9582045-b06b-4938-8269-71ab8cbf97ae", "comment": "Malware payload", "value": "c9c475a59a28ab132c9bccd06b196a88ae0ad57b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395051, "uuid": "84b5966b-b12a-4f09-a410-27f5a40a234d", "comment": "Malware payload", "value": "0a59a12b51f2b08a20ea3569c2ff5ec280e2fae0ea8b5b659614c73cc5fabf0d35b2886593f6f118705a5d14600c6955", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395051, "uuid": "d0c064a3-7452-40e8-8307-5d88b43b22fc", "value": "T1F8F5338E49924167E083ECF763C7D6239041B7164C88FB3E1E6A80DC9BD7792693295F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395051, "uuid": "a0df4d42-473d-492e-8450-d6d9dc06522f", "value": "99ceac7de052c1db3f48d6666eccac32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395051, "uuid": "79b7fdbe-f137-4c69-861c-4d8cb9e3f615", "value": "49152:sBdiXfJwdhjAeUDH4spkvpctgD+wrbW6t8SwZuvaKWzYBH+96p0qnAcR+AzVebmz:sngSFUb1QWtSwUvdWUt0qnT+OVyhZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395051, "uuid": "4c5dfa0c-ae1d-464d-9371-9c858ff91e2a", "value": 3496120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395051, "uuid": "1a15b4af-5f81-4548-9016-66692ad5291e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395051, "uuid": "e3fae116-cdf3-42ec-a1b7-d8c74a2edf0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2948df7-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383653, "uuid": "d3c65287-bf12-4562-9282-6c2cc1d6cdbe", "comment": "Malware payload (Mirai)", "value": "af367c65d96e3f6d61a8a11bf6539e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383653, "uuid": "82add17f-511c-42ab-9a0d-97c6f3158293", "comment": "Malware payload (Mirai)", "value": "d459e920bfae51461c5be3810d76c75370ed52bb45ac4e03c5c89873c36fe4f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383653, "uuid": "adfe720a-7e34-423d-bafc-18f7f3440c47", "comment": "Malware payload (Mirai)", "value": "753c700c7c3b16faf13cfcebce44a7481ec3045e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383653, "uuid": "d949057c-6e11-4691-870d-cbff98da66f2", "comment": "Malware payload (Mirai)", "value": "13528f0476a1f95e260d2d813cd1c9671eb3f90e132c825dd4a322090b9ec091e3c04bba9abf0730e5487a644e3b73dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383653, "uuid": "99932468-36b6-402d-a1d0-9f2c14006aff", "value": "T14A34398ADE650FEFC4AFCE34065E432719ED999B93F1A336457CCC48768E24846E3468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383653, "uuid": "174116f1-0ab4-4e3f-97c9-c869d5e9bfec", "value": "6144:D8E2+q2VZHWBDfNK661UJs78etN7ZzHRYmho039whOLu4NCb:D8sHWAgIzH13GhcNCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383653, "uuid": "3cbe797f-73d1-4443-9a5d-16061055eff7", "value": 249708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383653, "uuid": "ad9327c6-8e04-4237-997c-3d0474f4055b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383653, "uuid": "c5477279-5de4-4e26-9118-1f3b7c4ec624", "value": "disconnectraw.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1a345e-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786372660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372660, "uuid": "42ead94f-4ffd-4f21-87b7-c444e52f075b", "comment": "Malware payload (Stealc)", "value": "620c929007589fe980e5b627f0aa4b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372660, "uuid": "e5de4859-fb0a-4635-824f-0227fa1f01a9", "comment": "Malware payload (Stealc)", "value": "d4b2b8e2e22eeb76be64d1733ce4d6a59da2d8e243c3b21de8af7ae3019a718b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372660, "uuid": "4636ca80-dfb5-44de-bfba-36f634af9f8c", "comment": "Malware payload (Stealc)", "value": "e48f890fd2e0a0d173cf3d617470c6460ed821f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372660, "uuid": "bec9e712-097b-4a37-bd32-76007e138066", "comment": "Malware payload (Stealc)", "value": "ea343887c7e02a4f2fe3c9bea1892cd7d15bb57ec13aa593a5156bff4750f8847cdb120f19d55242612bcb2b258ac0e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372660, "uuid": "edbb13fd-4d49-4567-93ed-ff741e7ae2d5", "value": "T163F52319E7E405F8E163D2B5CD628811E772BC894771ABEF13E458A71F272809E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372660, "uuid": "99af2395-1462-45c2-9883-5d22c258542b", "value": "492a5d3560401c2811de048088bf91d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372660, "uuid": "93299335-5b5c-4140-be4b-f4d8edc9ec87", "value": "49152:vCgcvj6CsbcUMV/sQzSn0zGrnZsHRC+kklwUDyfQc29IHXYbzDrPBJe3KyJoOlMC:vCghwvVEhsGr1+k86IciIILrkvTcuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372660, "uuid": "584a84a4-f866-4c78-b4e4-8ec85034b785", "value": 3546080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372660, "uuid": "e8c91e25-a39a-4acd-8d7f-a930dd064766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372660, "uuid": "14112e4c-021e-43bd-8d40-69d18c31ad19", "value": "d4b2b8e2e22eeb76be64d1733ce4d6a59da2d8e243c3b21de8af7ae3019a718b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bac12ee-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369307, "uuid": "57c9365c-89af-47b8-960d-0516b814a2ae", "comment": "Malware payload (Vidar)", "value": "62453cb38da9e78fa09820404b377dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369307, "uuid": "4d4ac582-2eae-47ad-a964-3e6f61298851", "comment": "Malware payload (Vidar)", "value": "d4c0d46308409e2645075b145b805a4a84ba03a09d7aea06cd21ffba6dbefbf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369307, "uuid": "eab07215-4f15-4672-8756-10316643957e", "comment": "Malware payload (Vidar)", "value": "2196a6ac001f743d405e689b8c76ccc19dd9aaed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369307, "uuid": "1da8b7f7-324c-4ba0-936f-a49d6a8b7f78", "comment": "Malware payload (Vidar)", "value": "eaeea6e7d47b1d7c0f59fcdb5ff8de0c1789db2c7078c10148b591730439795879d6eeb84546e095c591325b6606397d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369307, "uuid": "3c4f9380-8508-4f8d-ba24-c3fb65e1cdd3", "value": "T14662D7C7F08361FDD5B9C339DA851277DA72709A132A5F7FD6CCA11236816102E687C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369307, "uuid": "6340282b-fecd-4917-991a-ac49cf0beced", "value": "183cf4601240c6239430ecafd27c9723", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369307, "uuid": "67048e7c-c5a5-4fca-94f2-a9cfa077b2a8", "value": "384:OcFZa9XPN2NiRWbI+kKX3fEYPdtuzkb/Rx7plOI:1FZ4P9WLdPdtckzRx/OI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369307, "uuid": "9fc75e8b-5873-4c23-943a-a17a049c5bfd", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369307, "uuid": "aca73e3d-79bf-482b-ac5b-5cdb2d45765f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369307, "uuid": "39a21dbd-db98-40b7-8417-78f28c2528f3", "value": "d4c0d46308409e2645075b145b805a4a84ba03a09d7aea06cd21ffba6dbefbf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec8edf4-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786372238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372238, "uuid": "9e59051e-51c2-4cb3-afbf-baa22a74cc33", "comment": "Malware payload (a310Logger)", "value": "0dfc1fed548cc604527435e9333449b0", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372238, "uuid": "77a71486-5fb8-4bb0-a998-771d5a06fceb", "comment": "Malware payload (a310Logger)", "value": "d54658dbc9712c5f0949ad0c5ffabb0ae6148d232d9b4a1ff97954b81c5d0a81", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372238, "uuid": "55d309c4-4b19-4ce4-b4a3-0ae4f859515a", "comment": "Malware payload (a310Logger)", "value": "34a3abacdae0c4c910b84c777d286f78ce50e48a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372238, "uuid": "a59d56f6-9013-48d6-8f01-72db47b92530", "comment": "Malware payload (a310Logger)", "value": "990b5cde407b09c4d3c678958ca42ec039b98a8215a95e0e9f5052c4380a66580cf21bfa0ec2f5a9487660633bac1b44", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372238, "uuid": "0499d989-5dcd-4da7-a70f-3773ad3a8ade", "value": "T19D944A13EB60A11EF1A389F0A9B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372238, "uuid": "ce67fb9c-7b63-405d-8b4a-c159aec5671e", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372238, "uuid": "2ebb9eb2-dea5-4318-a7d4-4621a7aa4b46", "value": "6144:JN8d1/w5KA81IJ8GpF6nuTmOOUiBUrjIXX0Q0/5eQ+t0xuG9E7yEGlTGJ:MjYKkJj6GmZUiqreUexp7yEGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372238, "uuid": "8581db52-a89b-4412-9555-60147e0dce71", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372238, "uuid": "7e180640-dddc-4d66-8082-165df0970b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372238, "uuid": "2f2e84f6-9961-403c-9d3d-86a7738909f6", "value": "d54658dbc9712c5f0949ad0c5ffabb0ae6148d232d9b4a1ff97954b81c5d0a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7690ffb8-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372842, "uuid": "71f85d1d-823c-4710-8f04-fc2e6bc5fea3", "comment": "Malware payload (Formbook)", "value": "32e674e9370a74bb7539710cd747d743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372842, "uuid": "e92ba88d-02fd-4739-8703-884db855dc29", "comment": "Malware payload (Formbook)", "value": "d5804dc8300985fa8f17989e100a128adcc745d861021c709c161163cf1be03c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372842, "uuid": "b3cf07be-03f1-400e-b0e6-c7c77a807c56", "comment": "Malware payload (Formbook)", "value": "e17707b50b34c6af83b6e71bcbcab742fecac633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372842, "uuid": "e93c9a6c-6bf3-4557-b654-1fc1bb489a25", "comment": "Malware payload (Formbook)", "value": "7fe5647ac5e98779ab506cecef465a737149646287357947b76798f46f04d77209c1090a4343f52b121d881eb2acbce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372842, "uuid": "88360001-73b4-42b1-ac01-810a6ad90e2a", "value": "T17435F114130A9A42E0E68BF5B861D37437B80DCE79E2D3D69FF96FEB39193C01958192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372842, "uuid": "50883d03-4ea7-466c-8edc-7c6a7655935e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372842, "uuid": "00340f7c-a2b6-485e-916c-45aad46b0ab2", "value": "12288:vd2Sxo8xEXZt2T5EzraGTrcp/f34Y5r5DbN0Hl2Paq42dGyr1ZzkDWWjOn9JcAxh:VzZ+25E3aLp4Y5BNmvqHdZr1FJHp50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372842, "uuid": "463fcced-6869-4adf-a73b-708a2b6110cb", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372842, "uuid": "4d591888-715c-4c40-8a2b-8901027eb6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372842, "uuid": "bcc5f823-f114-4ae0-89c0-5920f11475bc", "value": "d5804dc8300985fa8f17989e100a128adcc745d861021c709c161163cf1be03c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bdf8bb-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786369614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369614, "uuid": "82d373e1-0658-4a08-955b-1ed5126f112c", "comment": "Malware payload (njrat)", "value": "80a6ca0e05a3daf2f497df813631a988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369614, "uuid": "3ce00dc6-136b-4c9d-9596-55e78b29601e", "comment": "Malware payload (njrat)", "value": "d5e81ce2c3e3557512654369d3e3f88ed52814b604265df0168834cb2b82251d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369614, "uuid": "c98e6a96-d10f-4b14-9ffc-a0435ed9eb55", "comment": "Malware payload (njrat)", "value": "67a3c28e04243c0a6632984d6e525e5c4e10aa48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369614, "uuid": "e116a4f3-e8d1-4cee-b9f8-d81dde527ba5", "comment": "Malware payload (njrat)", "value": "3ce0fdfa25216612699a91b5bd6a33758d2a41f615814fb68449a6cfaff9c129422aff3f01edf4cfb6bf9cd42a9709bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369614, "uuid": "082071fa-e592-430b-a95a-927729066ee0", "value": "T1AD0512945F5FC823C8C15B301AA0F37962785C99E9128A1B9BFDFEDB3439D166C08D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369614, "uuid": "7011ede8-45cf-4a7f-b454-0240db3d7c5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369614, "uuid": "7d1e2b86-06a8-4d0f-97b9-737f76c9dbf4", "value": "12288:hWpc7FaMnAqgnDo9gcEQbTUvk/sTp+c4mWkU8pXu7DuvRSOTKEur3CdxjfUYg:0p+Nqo9xEQbTx+pvWkUvDuv/zurAJpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369614, "uuid": "2b4da08a-04f3-4144-8f2e-42cb8c802306", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369614, "uuid": "b0a80981-ee79-486d-926d-f46d579fef65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369614, "uuid": "a08d5c60-d3f3-4567-a34e-9210f6159a35", "value": "d5e81ce2c3e3557512654369d3e3f88ed52814b604265df0168834cb2b82251d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751d9971-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "a3953da8-12ba-461e-bf9a-6bff6c310344", "comment": "Malware payload (Mirai)", "value": "3afa64817e8416aa32dac6ca17db1408", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "5206e9a9-90f8-44a8-8aa6-b3d2ec07f790", "comment": "Malware payload (Mirai)", "value": "d6d1c5cf52e565ce153fa23a121ef7cc242935152b9ee8ba9202aa648a6aba1c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "971640ec-39dc-417c-9cc2-7b18d4896af6", "comment": "Malware payload (Mirai)", "value": "87c09d6811b132ef54e509ff193ab60f36e7ebd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "18e7f9e3-1127-4921-8e7e-c7d516d013a8", "comment": "Malware payload (Mirai)", "value": "6e5e247dcc5b526549a86a66662065321b371bf508c8da80d42b5bb2d909af95c3b835d43e13771de8b1403e002f1886", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "49fdcce8-71c7-4326-bc72-b721365ce675", "value": "T165145A02732D4D07D1A32EB0373F27E193EF9A9225E4B540295EAF9E8075E325945ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "1d5dd3e8-6222-4753-84db-4d9b53b98ef6", "value": "3072:m656afrvaPxQbMJY3WrahEGq7nKMxxw7KLXCX9Met9kGf:p56azvaPm4JEWghMxxw7KjW1t+Gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356948, "uuid": "75fc7c62-2497-4788-8e2a-11ffe09ecd49", "value": 200816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356948, "uuid": "a3da6a40-e4e8-400f-b2ce-d09cf064e8f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "7269e5ec-9753-41a3-8722-134e13be4882", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3303383b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371440, "uuid": "7ee5b4a2-eb04-40ec-b3ae-f2565b7f8c73", "comment": "Malware payload", "value": "1ec3ccb73ef98e16431612a7ad9f8900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371440, "uuid": "52cb84b6-8330-4178-80a3-8f7dd3d12182", "comment": "Malware payload", "value": "d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371440, "uuid": "2be94a11-acb8-40a0-bfc3-e5063e8f7ac3", "comment": "Malware payload", "value": "54d49c75f34cc832f08a553fd4c9663d61ee7531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371440, "uuid": "f83db1dc-55ff-4b5e-988f-1d9bea1c530c", "comment": "Malware payload", "value": "aad98817dd1a6b77820ce7478b11d772110a7c400bb8d04dd2ccdffe64c041970b4558c363435c26cd3076ddc9cef501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371440, "uuid": "26939468-2d39-49f0-9443-6e4f3b05c82f", "value": "T182E41201EB86D8D8C53285B5E6F2E2F255307DECDA35661B16057F6EBC31BE0CA7A201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371440, "uuid": "730a12b8-ff83-4e03-88c4-218985a3b9b2", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371440, "uuid": "31db576f-d5f1-4b3a-a9d6-2dbe9300aae3", "value": "12288:Jtg++Nmxxy6BhAEPrwaWkCQjSX/jr/c13aQRHWxOzJ8T6Ll6Cvy4fKSCci:JMNmnBhtdTjSXLr/cgbxOt46ZBySDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371440, "uuid": "c59148d6-d9ad-4ab6-b80b-1248d30064e7", "value": 664952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371440, "uuid": "53823fa3-dbed-4cdd-a485-90db88dbf4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371440, "uuid": "c28d398c-38a4-416e-a942-b91356883f18", "value": "d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7414b8-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368610, "uuid": "2446fba5-aaaa-4fd5-b4ac-fe6ac6355a49", "comment": "Malware payload", "value": "76d351faa07dcf1f89be09202edc433a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368610, "uuid": "5a70bef6-c434-4f88-a450-233f2e56350b", "comment": "Malware payload", "value": "d71a0da5f067d8838a136eb26d8d35bc84e9356d057d2e15e3fc460999ae1926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368610, "uuid": "92b8de58-8f80-4460-8830-bca502785634", "comment": "Malware payload", "value": "cdbc6c3a48ef03b8ecb80c25fa8c848799769d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368610, "uuid": "9ee9cb5c-f373-4d2d-87c5-3b48200d881b", "comment": "Malware payload", "value": "101737b7225ddd65d04a05f1c23b6f8afc8a42c2235d6b6a03a59eec100b34aaca5cb0978ee1971a1c9f213cb1585d71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368610, "uuid": "f35e5230-c64b-46ce-a83b-ff9c7bd61a07", "value": "T1F65413113760C817DB7212303D3696752AA6DBBE2512C2BF2B909BDA7C71DA15D0F23B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368610, "uuid": "06772919-2b2d-4ffe-84b5-5b32b685e251", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368610, "uuid": "afba196f-f526-4bff-8204-ea78c7167947", "value": "6144:40Mm4CCx78Zmfz2vymL4DqSWNzIOIRpx3jDohZFN3kml+jiBAR:fMwI74gSymLMqbJfApxTDonFNUbji+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368610, "uuid": "18eaafc4-eaae-4c63-b0ab-a7bca34661b6", "value": 305592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368610, "uuid": "b199321c-4e89-4b88-9a0f-98b13ee0eb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368610, "uuid": "9c3f88d0-d8e6-4c17-a93d-adeeb8591dc7", "value": "d71a0da5f067d8838a136eb26d8d35bc84e9356d057d2e15e3fc460999ae1926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0512d1-945d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786326578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326578, "uuid": "d129bdb1-b639-479a-b987-c9197a793e86", "comment": "Malware payload", "value": "d37e62a4cfd3c0c807a559b92d26b85d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326578, "uuid": "87b6a293-7733-4448-8a80-a46ec4f516c7", "comment": "Malware payload", "value": "d7367a850acb0ee789a09dd4ac407163905856935d955bae53e9554055899ceb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326578, "uuid": "42aacc28-5b73-4744-814a-f513a67cbf38", "comment": "Malware payload", "value": "c6cc31058e9939642c777c8b98465b629213f529", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326578, "uuid": "68a93843-ffc6-436e-86b2-ba540dd4183e", "comment": "Malware payload", "value": "6ea81f968da3c5c1b721cc0f14a02155e803d4cece7811d57905797bafd890cb5d918ad7c1b6abebabf33d97cb39533c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326578, "uuid": "b96a1382-9131-461e-a043-c63bb56ab905", "value": "T1B0236C551A957C14AA98C4371D7E2F0CBDA943E6320452EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326578, "uuid": "51c9ffe7-c288-4674-afae-ea390b5d6135", "value": "768:SVEJVIhtML9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:oEJ2M8cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786326578, "uuid": "d8c192d2-346f-4208-ad69-3c654ed2ae8e", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786326578, "uuid": "dfe97d82-3237-44ed-9f05-93dc12670ddc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326578, "uuid": "1bb69993-c1ff-437c-803f-e1039c03ac94", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7babdc5a-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "b74a7ff1-ca06-4c8e-89a1-d8fdd98604fb", "comment": "Malware payload (Mirai)", "value": "35abf82fa66eb7fdfbce74a09c08c63f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "af395934-73b7-4788-ac2e-d5867796625c", "comment": "Malware payload (Mirai)", "value": "d74a5c2ca22252d20817a3ad33283f9e13e1c54bd351bc645445f78239b3160f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "d0a982f8-e4d6-45c5-a57c-6fb8ecb1a7f3", "comment": "Malware payload (Mirai)", "value": "7b24846e25946ba200272300154630de809f1208", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "61a35d4a-1965-4e98-819c-a702ac2fb7dd", "comment": "Malware payload (Mirai)", "value": "b2f34546fc6585f0fef84caf339edb99a46558b9aaa5ac0bf4c48cdb2d4ae90defbcdb7a4375350d1d20a2a7193aeb11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "a08a3987-7d10-4419-bb6d-325f0c1e906f", "value": "T1727312561F84F573DE02B0774E5A55E1F2B0F734B43BE18A3208EA699A0CDACD60E835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "6f8f4a3e-c15d-4aaf-bc87-45dfc3a9e5de", "value": "1536:5dkjXXENNpmbMviRIGD5xITFl/4DcdSOQz:5dK0IbMvypWlQDcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383588, "uuid": "c41ace8d-220e-424c-96c3-c8dffb1d7858", "value": 79284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383588, "uuid": "2ae78f1f-249e-4c05-a3d3-d9198e4aea7f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "d968515d-6279-477f-8c8b-14bbd82941bf", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c9c0bc-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371421, "uuid": "25ee9beb-4cec-4bb8-902a-f488ed6d1fa9", "comment": "Malware payload", "value": "57f7ed9171997342e8334fbc222b0332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371421, "uuid": "7a7124d0-93f0-4f9a-91f3-d90dc7e0014a", "comment": "Malware payload", "value": "d7917acb9cdb15446847d6d5f5c899ac8c4a3ff9293c09ed21c5e3fde5e152c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371421, "uuid": "8f6de62a-45e2-4dd1-8489-beb9fb24f454", "comment": "Malware payload", "value": "7d8dd534fd154308f00013476b6d9227e0ce6181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371421, "uuid": "748b66ef-068a-4879-837b-562123ac6a42", "comment": "Malware payload", "value": "e9f8a25cc5e9d4bbfc380a685bbde292850857ee4c2d6c3676a4fc023d75fa561506d89cb22f80863006ec4f4d178858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371421, "uuid": "9f5a036d-c1fb-45dc-92be-da045020d4bb", "value": "T1C883F1E3F2E65D91D1AB06BD2093D49110FBE406FE3B9BBD5ACC14899F02B4097A5F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371421, "uuid": "eb115355-eff1-4bbb-b8f9-f5b31438c23c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371421, "uuid": "455c8426-252a-4b76-9825-74055991c59d", "value": "1536:ppbfiOG0KhkAjokUTt+804/7NZ1qQXp/tPkM3tsoGDPud2qDD7j7OaTeTk:ppbf07hDjtgb/7NZwkp/tPd9n/DTOaTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371421, "uuid": "43a2ae4d-0513-4a88-bc69-60b360903c5b", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371421, "uuid": "874c8358-9c34-4675-bda4-a21fc0cd2736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371421, "uuid": "009b3233-0508-49d7-b9cc-9ca5abb092d3", "value": "d7917acb9cdb15446847d6d5f5c899ac8c4a3ff9293c09ed21c5e3fde5e152c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab11b066-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371641, "uuid": "7dde8f63-385d-40c4-b9e5-146175a33b0b", "comment": "Malware payload (AgentTesla)", "value": "43ccea6207ab42d96e3422baeeae710a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371641, "uuid": "7473812a-5206-40c8-8495-7766ccbba8b7", "comment": "Malware payload (AgentTesla)", "value": "d798cac683a86d3bca60ed05460ec4c7d4e4331834429763e0ef96fd5ac7d88b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371641, "uuid": "3ca4e2e8-2f18-4cea-9659-6decaa78d8c2", "comment": "Malware payload (AgentTesla)", "value": "2234367e67de5b2994c225121265de0e047eff2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371641, "uuid": "9560a29b-81df-42d8-8b32-42b78341db8b", "comment": "Malware payload (AgentTesla)", "value": "640b7dcf0c67c68c8c8a840d6903101d4e844a8bdbfa1d124c9c2f61d70912818f204b52af90abc1f527b7a57f66430c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371641, "uuid": "b04f6bc0-ce30-4767-87aa-457288153a41", "value": "T1743512486B82E613C9A517751EB0F77802BCADAAB810D2139FDEBE9F7D32B015C50197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371641, "uuid": "0ccb4a18-5c46-4e9a-8e97-38659865a577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371641, "uuid": "7369d7b6-13aa-4313-a868-c8a8d4f73721", "value": "24576:t5Y6p0tYQn7YQNXFQEv8MokYEl4512fh8mcJeKd6e5KeZ:lKGQn7Zdv8Mokh45gfh8mjK0YKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371641, "uuid": "4c4780ab-bfcf-4ffc-a8e4-a27be7db14cf", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371641, "uuid": "c04b3142-22fc-4f8b-896b-86b0b52a3c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371641, "uuid": "6fe3e10f-3de2-42ec-b215-0f1025861368", "value": "d798cac683a86d3bca60ed05460ec4c7d4e4331834429763e0ef96fd5ac7d88b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39057a59-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786370591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370591, "uuid": "52caf7d7-fb62-4431-bb84-e380ec0139ab", "comment": "Malware payload (AsyncRAT)", "value": "c4351c6836b055524d68ea1bf2c5428a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370591, "uuid": "ce9a6f80-f161-44b2-9105-30c797e31d2f", "comment": "Malware payload (AsyncRAT)", "value": "d7adcdad2dc0743c188db7314028ce74827a81fc3eee6b38bf9d0e9f57c7f222", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370591, "uuid": "9eb27d33-0f7d-400a-a888-f9973a55d176", "comment": "Malware payload (AsyncRAT)", "value": "8623a5639f03c503a915f9e4c1f08f257ed1c360", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370591, "uuid": "cf6aa28e-16b1-49dc-b9ab-2f6627562e27", "comment": "Malware payload (AsyncRAT)", "value": "6ba3daab65d141c892569b1d84d50fc6907b955b3fe0e75ed8ef8eaf3928dd5d818be41c25123c03dee10e7063504e3a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370591, "uuid": "57d66b82-fa15-4097-b4dd-cb5d8081ed90", "value": "T13A1512246A49CC05D4D60B759460E37D53F2BE6DE432C31A8FECAF9B3A677016908BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370591, "uuid": "b70fff5d-f202-42fa-8348-1375e3e18eea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370591, "uuid": "bf63d592-f5c6-46c6-b0d8-db35dd8dbc1f", "value": "24576:LZ7U3FmSxIdrLH8crZZyV5jUTNz9U64EbzQTd:do3FIrb8aZZe5UNdcTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370591, "uuid": "3b7bf7e7-f957-468f-8053-077b7c8c96e5", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370591, "uuid": "27d74a2c-35d1-4658-8467-fe87605c1b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370591, "uuid": "8667243c-a102-4956-a556-57a0652d384b", "value": "d7adcdad2dc0743c188db7314028ce74827a81fc3eee6b38bf9d0e9f57c7f222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa621f69-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786369627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369627, "uuid": "4416b546-87ca-4c07-bc78-6f4edb70ec2b", "comment": "Malware payload (AsyncRAT)", "value": "44f08db8f8cff70110fffcaa904fce59", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369627, "uuid": "0149fdd8-1f96-4a35-aba5-698da11b8ed4", "comment": "Malware payload (AsyncRAT)", "value": "d7beff6c8488d84321d9e1995da87e55c13fcd4b45b2e4e1e96cda5a82691c9e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369627, "uuid": "6e53818e-1b44-4bfa-b2b1-32a2bcf6ffb9", "comment": "Malware payload (AsyncRAT)", "value": "65ebe8c0a1a3c3dd40d859dd06ec3ce62d46e6db", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369627, "uuid": "44e55576-5b5c-4986-bf82-e1f69eff6724", "comment": "Malware payload (AsyncRAT)", "value": "cbb6a155b6b72bb0a9ddcedb2f80b15c9959884e6fb661d1b372ffee32dd886a14bafb5b3f76db4a6ccda4081164f552", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369627, "uuid": "c6599311-0a74-4603-a16b-c998a682648e", "value": "T1710502A47E9ED821C4E257700960E23853F66DC9F531CA178BECECD339AAB076D90B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369627, "uuid": "884d649a-2f64-48e3-a8e0-e87aa6613aa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369627, "uuid": "a0fd7809-1613-41ac-b543-af07add893a7", "value": "24576:e8dpBEkgaLZt1rMdIZFbcMuIiUU9Wrdas:3dpBEkgIZzbTbrMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369627, "uuid": "49748b72-634b-403f-9b7e-c16dce41cc2b", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369627, "uuid": "c3c3dfd4-da5a-4746-b499-c2e825f00323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369627, "uuid": "e1b22bc8-6d7b-47ed-8a01-c3d04a48b290", "value": "d7beff6c8488d84321d9e1995da87e55c13fcd4b45b2e4e1e96cda5a82691c9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a2502b-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372968, "uuid": "918cf5ed-d501-499a-abfe-4ff30f005b4a", "comment": "Malware payload", "value": "27483fef454a57bc8a44eb23965294f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372968, "uuid": "70cfc6a8-9c1f-4eed-9378-9fc8bfda8e54", "comment": "Malware payload", "value": "d7ce551a01b220b1f20dfbb6af9f41f3a17e7b7406bff3914cc2ea76883e0eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372968, "uuid": "84b9c734-52e5-43b1-ab80-88580a8980d8", "comment": "Malware payload", "value": "55f3020eeca90e846eeb8ce6a21d92bce9658372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372968, "uuid": "c453c35d-ec5f-430a-a74a-2002c974ab5e", "comment": "Malware payload", "value": "99a881c7331d370b0c0b04210ea6d8fe83e226be1428ed71e4b685a322e7e8394d5fa6fc4c86b870947b5d0fd23e67f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372968, "uuid": "19a663d7-a9f8-4a6f-9e56-847371167257", "value": "T17775E046D9822690DE289B38D236CC3453B16DAE5534E62E2DCD3EF37FBB7862016057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372968, "uuid": "7888b6dd-c9d8-4f07-8991-68b527debe6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372968, "uuid": "a3f780f6-6577-4eca-bdb0-8982cfc2bbd3", "value": "24576:JW5DxfDWxWBwCzvRa0+F0Ikyo1zT+EhtqfrYEzRDtMfLheuCIB71q:iDckwAvs3F0JyoBvhtqf0+RxumIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372968, "uuid": "1e79a55a-d670-45a6-aa7a-32af882760f6", "value": 1647104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372968, "uuid": "3f8b191f-f0b8-455e-bd2a-54dbfa26e5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372968, "uuid": "a20c8ddf-0bca-46d1-81a5-d4ca87bbf1d7", "value": "d7ce551a01b220b1f20dfbb6af9f41f3a17e7b7406bff3914cc2ea76883e0eb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb9a81b-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786368502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368502, "uuid": "bfe72d43-9e6b-4928-9528-c9b73c9276cb", "comment": "Malware payload (PhantomStealer)", "value": "30c5f66660e9c5f00e1853beee3788e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368502, "uuid": "87208e00-568e-4fbf-bdf0-5a5f4a14694f", "comment": "Malware payload (PhantomStealer)", "value": "d8997939178de5e376c31476777c7f99938695105f976948540873fb37354b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368502, "uuid": "b42787e3-08d1-4159-b247-5c2eada0176c", "comment": "Malware payload (PhantomStealer)", "value": "1ee221825c01f234c896fddb52ae184edcc2f59d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368502, "uuid": "b03382bb-d0ff-41c9-b7bf-ade11f114690", "comment": "Malware payload (PhantomStealer)", "value": "8ef9f6422c6620a7228b841f95a1cdc113d3d43a4353db8b9c48696f4f07b82dbedd4d1835a8c5664446245b9291416c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368502, "uuid": "3831617c-ebcb-400e-864a-9aeba9b8e602", "value": "T1C87501C03B367B06EEB55A349635EEB843B92D69B411F5960DD93BAB74AC2014E0CF43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368502, "uuid": "de6599fb-b607-41be-a054-227ce2fa11f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368502, "uuid": "0e8591d0-6ea1-44fe-b492-8bd5558af743", "value": "49152:9mdeSGhHEILsqrIJQl02KP8IfKPO6++Rvu+r42:6efEHqrIJJ2KVfKPsna4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368502, "uuid": "bbf4b1dc-0f3a-4ec3-89c3-8b6170e6154b", "value": 1580544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368502, "uuid": "cdb13819-0646-41c8-8f34-5c4761b1305b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368502, "uuid": "08540b45-49bb-4aef-95a9-5614ba823002", "value": "d8997939178de5e376c31476777c7f99938695105f976948540873fb37354b5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39120789-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372309, "uuid": "b393af7f-c2b3-4a55-b695-e5c2b381dc6c", "comment": "Malware payload", "value": "4d41b364e9193f45adabf5a66fde7111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372309, "uuid": "8d87ed75-5c52-44e3-ad14-c713bb22d5d0", "comment": "Malware payload", "value": "d8a70b70e8772232f9e5947a10a959df2aba5357124eefc1970474e21a9a2b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372309, "uuid": "8e7f3052-8e68-4f72-9f4c-58a2b65e9eb9", "comment": "Malware payload", "value": "828a5828255630e49769a0ef47549b56edccc56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372309, "uuid": "75876380-89e4-4db7-acb1-50b9b81ea4d2", "comment": "Malware payload", "value": "992e5aca7c2fad07abf56c71d6a92056734441f215f366a2914f83cb1a979ac88118252522893d0b4d4eb4b508384bf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372309, "uuid": "d8afa4cc-b9ca-41dd-b475-0f7873bae53a", "value": "T1B755BF21B69790F3D6563A7014BA2B3F9E3DAE460B15CBC39364EE2C6C321C19D3715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372309, "uuid": "e6b06cbe-fc69-44c1-96ac-891a5176b0da", "value": "4ca36c0623611345ee5fabf3cf68d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372309, "uuid": "4fbb5536-f5c9-45e5-9713-006048a753c1", "value": "24576:pHV2ZTHxI0xvmodlG4u0sfOa49ukQwFn3nWBWic9uRsU7r:pHV2Z+0xJlG4lwd49Smtic9yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372309, "uuid": "38be6a0a-3c00-4640-a20f-061d7057d83a", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372309, "uuid": "bf29bc50-d6da-4ca1-9e75-d10542c74468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372309, "uuid": "be9308aa-48b9-4eb5-bf3c-db4d35d086ff", "value": "d8a70b70e8772232f9e5947a10a959df2aba5357124eefc1970474e21a9a2b18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c6ce76-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "4cfa0d93-398d-49b2-beec-2c9177ca370c", "comment": "Malware payload (Mirai)", "value": "b9b941fb9dbfb68b2bc05a87e6109b80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "a6f89751-01f4-404f-990a-aa26120fd966", "comment": "Malware payload (Mirai)", "value": "d8a9c3c7797c11cfee0c17fffcbf43135479afe22b29cf647e1c80cd30d970a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "70b052b7-045a-44c5-9ba5-ad529adfdf66", "comment": "Malware payload (Mirai)", "value": "7cbe68890072a93556389dbd228a39182ecb587f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "fe4a0674-3161-43d8-a07d-394c0b755847", "comment": "Malware payload (Mirai)", "value": "b422aa415ffde6479dea8c9170d998d27ad3b6976180cb144d13b5a6165e2562539f57cfe279a38f9c1d9861e5eae1c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356838, "uuid": "6375aaea-7073-41d5-9f3f-a88e404cfecc", "value": "T11244C71E6E229F7DF369877447B74E34A76923D623E1D580E1ACC1101E6438E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356838, "uuid": "1129c7e2-8244-4a73-bb87-5f1783ac2e23", "value": "3072:Op8GOCWKGSDLEx1gCugdcEWx7fecEmLOV+aSIRLWgb6+nP+bxV6loiLyqC4SEwL:OpHOCWBSD0czx7ebTjBPSVhyylPEwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356838, "uuid": "64a034fb-1258-4ca9-8c0f-7cf46f3b3f9c", "value": 258580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356838, "uuid": "c6329131-06f9-40cf-a41e-6799870f11c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356838, "uuid": "d784145b-1fc6-484a-95e3-12ca2a707a2f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a061ec3c-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1786370765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370765, "uuid": "8b20c314-9b59-4a8a-b97a-cf45f03eaa38", "comment": "Malware payload (ArkeiStealer)", "value": "4ebd765e6a56fe0f1d5d9f7f6f6a6ba6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370765, "uuid": "60c79c48-562a-4706-8893-9deeb4c6e83f", "comment": "Malware payload (ArkeiStealer)", "value": "d8ee708b4bde48eb11a3d4f557c65ae08f9955e830ff50b8b9cf8b9b972d70b0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370765, "uuid": "44a920b4-f487-4e64-a901-4d883528500e", "comment": "Malware payload (ArkeiStealer)", "value": "119001d404983a07f47354eb9234bf6a57e2b0dd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370765, "uuid": "fe3fbca4-61e9-456e-957a-7dce5ff30282", "comment": "Malware payload (ArkeiStealer)", "value": "6889154a63cb9a738ac87b31626befc813ade92996952e8617f7678690bcb66b052e44e22be8fe090211f60364107f12", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370765, "uuid": "1ed4f202-9bf0-48e8-b7ad-06f4dadff94c", "value": "T180D58C0B6CD009FAC4AA933189B642927774BC594F3223D72E90B7382F76BE19C79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370765, "uuid": "3aa577a1-5734-4823-bf3b-be46a5a79a5a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370765, "uuid": "fa2220f6-4cee-421e-b645-b0ad5e79a38b", "value": "49152:wQA3qV6TIh8YjgTXnkGlFpa+HhFfpyjE6WxbwsXn:wQzroXXEWxUsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370765, "uuid": "3cbdd816-4db7-43b6-9f52-b4a65a353c72", "value": 2889616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370765, "uuid": "1a139726-d5a3-45aa-932b-d8a52780f48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370765, "uuid": "4aa373b5-fdd1-4018-ad07-218861897f60", "value": "d8ee708b4bde48eb11a3d4f557c65ae08f9955e830ff50b8b9cf8b9b972d70b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56adb55-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370397, "uuid": "2a224110-a2eb-49a5-96da-4e7e1edcfcde", "comment": "Malware payload (AgentTesla)", "value": "9d3c0cd374c102130866ca6c6847cb50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370397, "uuid": "4d17eff6-b307-42b3-a3fc-5eeb39bdbcdf", "comment": "Malware payload (AgentTesla)", "value": "d8f14099d0dff76cf45aa6bb27b3a1ef663f44984445f11c476424cabedef8bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370397, "uuid": "d206a763-70c5-4cc8-aaad-77b893b2ab63", "comment": "Malware payload (AgentTesla)", "value": "8b80523865f800053abcd7b2abb965c73e8fca3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370397, "uuid": "03fc8afc-8eb7-4f0a-a715-c1c8efd5817a", "comment": "Malware payload (AgentTesla)", "value": "48ce7edfaa2b2989ca5fd391588faffeb1ac042ccf034d0f1617ab905c768a6ce7cba6c4da7a6b7c69d780205d52fcd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370397, "uuid": "44c9ffea-ec9b-4bb1-9087-95846cbe26db", "value": "T1A9F4CF151D462A78DA7E2BB8C0D3344423F0FCF792A6D61A6EED30ECDAB2B80C9D5551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370397, "uuid": "b41cc6f1-08cc-4fdb-aead-e30a25c9e027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370397, "uuid": "dbd3b6c4-696c-4a3c-8b30-a45bcceec69d", "value": "12288:7DNiCNxTWh5YX8kBzdG7oe9mxHewPrQjq9gpsNLZkV:7+50jhwH7krKXY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370397, "uuid": "18611578-7129-450b-bd44-12f55d27512f", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370397, "uuid": "118ce248-7329-4042-ad69-dc41fe6e8bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370397, "uuid": "2cf309a1-e497-4a2e-9685-7652511ffc8a", "value": "d8f14099d0dff76cf45aa6bb27b3a1ef663f44984445f11c476424cabedef8bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2da3995-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786369480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369480, "uuid": "4e6ee920-1432-425e-8a9b-f4719448a8cf", "comment": "Malware payload (a310Logger)", "value": "af241fb458af533000e082486980c6db", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369480, "uuid": "38b28092-02e9-4932-979b-330f7e157472", "comment": "Malware payload (a310Logger)", "value": "d8fc6ab0c070118651ca85c03f6da9ce8d56a607147b4de9e5b69689ba362adc", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369480, "uuid": "5badf71d-d871-4138-aab2-d474adfc304a", "comment": "Malware payload (a310Logger)", "value": "32aa169227c5260d757f26415a51a7d868d72cd6", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369480, "uuid": "fd93a2fc-721a-44b1-8908-fca625eb5990", "comment": "Malware payload (a310Logger)", "value": "807bda40ce09a22c206d88e1caf6044186b87fe5faf113c612c0f46d4e711e991e163078ff0ace78baa3a5ef38b0eac5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369480, "uuid": "3aeef63e-daa0-45f0-a872-c78a2482e4ca", "value": "T14E943A13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369480, "uuid": "e3bdd071-0293-48e3-b3b7-0f88e9e086e2", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369480, "uuid": "869fa2da-716e-4aa6-ab8d-bbfad5120b79", "value": "6144:Br8d1/w5KA81IJ8GpF6nuTmOOUiBUrjAzgXNd+kDkbWWFV5fymwy0qDzXVfs:BwjYKkJj6GmZUiqrrN+bHxwy0qDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369480, "uuid": "e1f01343-ef2b-4c8c-bee2-9c8e1d10401d", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369480, "uuid": "626afafc-8fcc-459d-873b-a140e8344b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369480, "uuid": "283fcbe3-456e-4eb8-bea1-d68a4273c076", "value": "d8fc6ab0c070118651ca85c03f6da9ce8d56a607147b4de9e5b69689ba362adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32a060b-94a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786358019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358019, "uuid": "93e58948-2d4a-40ee-9b87-7c068ab2a0dc", "comment": "Malware payload (ValleyRAT)", "value": "668a57088e03c81323e77d2a9017c1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358019, "uuid": "8b921503-ba60-4c08-9ce1-2f24f5257de1", "comment": "Malware payload (ValleyRAT)", "value": "d9017fb9a03e7cb7eda1df21922d37e693c6d7a8261bd9757d19171778d7a2c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358019, "uuid": "53283af7-ce3a-42fa-9aab-8dd3b884eb25", "comment": "Malware payload (ValleyRAT)", "value": "70105317670b912737e2a7e631db09881abecb39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358019, "uuid": "ecaa5937-4f51-4edc-8794-8dd525f2b501", "comment": "Malware payload (ValleyRAT)", "value": "fa269a65995e7b4d1d1bcdbec165f657c0b4595e2607b3749f9064bd62b65d6a035d51775e27b628b127ba7fbb08c1b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358019, "uuid": "1ebd85dd-e3c6-4e05-90b6-2e15c77629d4", "value": "T11916AD24BDBA812DD027FFB83DECF59EE9EB66191506646B001703478626AC0CF4B5BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358019, "uuid": "5c78c8ee-5b06-4f56-8a68-cd422a322dc6", "value": "74cb9ee7979b63f33a56f1b4262ad794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358019, "uuid": "2892ccc6-ab86-41a7-a08d-733ae0ee618b", "value": "12288:Li8rIlAL3dFOZHEN4GSxvST+uNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+ScsTLTXN:LijSw7GSxv7UeCGg0iNskg8lG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786358019, "uuid": "48dee83c-f777-406c-b866-29cf3438c630", "value": 4046664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786358019, "uuid": "b361bd3e-8a52-4949-a0b6-f0a1818d6602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358019, "uuid": "6fb8a44e-a9ab-4d50-86dc-8e907add72ba", "value": "\u817e\u9f99\u81ea\u52a9\u63a5\u7801\u7535\u8111\u7aefv1.2.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdbef5c-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348423, "uuid": "1d7d8d6a-ba82-44aa-acd3-1fa2803b6d0a", "comment": "Malware payload", "value": "214e9af604c6eca2a518dd8d3b92b43f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348423, "uuid": "bbb13885-67c6-403f-a8ce-621d4e623bd6", "comment": "Malware payload", "value": "d91b682f159578b75374435ca516149359c977021473293a6b3727da7bac9afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348423, "uuid": "ece0024a-9648-4936-ace8-dc796c603917", "comment": "Malware payload", "value": "8785154a4e8b5ef73a5633449df6c5401ccff1d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348423, "uuid": "eab7d724-07ec-4d77-a210-2906c5068e77", "comment": "Malware payload", "value": "bfcad5ce2173eb73e5f3d92b4a14322394be7497c4bf362bdc1cca518dd31a6c59872f8faed63e72d0b0066f1219aae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348423, "uuid": "735b1871-1186-4b41-84d5-17e447816261", "value": "T14D43F83B3484A3F4F58156B07BE7A3B27C640BFF1096A09B5652161ABAF077B603C947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348423, "uuid": "92dbcccc-81f6-4724-b75a-2c1bfbb6df8f", "value": "1536:qcwZ6Z6xs4FmFslpdELBwFoKqlmoNtWJlY+C0:WZhZplpyLBio3oktmnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348423, "uuid": "415e476a-366d-418c-aa3f-3b3b08b2c8a0", "value": 58144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348423, "uuid": "ab045a10-46b0-4fe5-9a36-abf8b20747b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348423, "uuid": "1f4f6af7-0971-4b4c-9af7-3443dadf64d1", "value": "main.openrisc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed77e13-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373983, "uuid": "74eb8523-2918-462f-9242-8ebf3be65ebb", "comment": "Malware payload (GuLoader)", "value": "6ae0f756b2c7dadec7365338034b6653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373983, "uuid": "6a80574b-76bb-4f06-b53e-784adff117bf", "comment": "Malware payload (GuLoader)", "value": "d92357ca2e0ca95db655aa795ee333753b424603b7159744caa08adc3a6d9feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373983, "uuid": "6cc3f633-ac9b-4fea-8eb3-cba2fd10f241", "comment": "Malware payload (GuLoader)", "value": "3115f36e557dfb7dbe9aa7e0331f266310c22f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373983, "uuid": "b67a5275-f4e1-43d2-9dff-3081a0dc463a", "comment": "Malware payload (GuLoader)", "value": "1a6cb01842ddd3fd29b032101945259045d7796aa7a232a6a24da1f4ca3387ed8b2e321079030874761bb0debf6043d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373983, "uuid": "067883ef-6a3e-4c71-b667-0b31f7cfa5d5", "value": "T100C42361EBE0D8AAD4990873CD3266F3CAADAD71D75856C70B403D4DBE72342892F351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373983, "uuid": "b8813b69-553b-40d1-96ab-3ac7b4da0d50", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373983, "uuid": "15aa4adc-544f-49e5-96ad-0ccd8e61a49e", "value": "12288:4fYPo/gfgMUCezQz1bJPqItJSfgpf6DtdzfW9u:4fYPo/cgIezQxTpat9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373983, "uuid": "c3b03e5b-4dfe-48ea-9df7-9b07f7d6c475", "value": 580424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373983, "uuid": "ce11f28f-5570-4eb5-98b9-6353c21f3cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373983, "uuid": "9b297ec5-7122-49be-9a67-e8e8a7f26683", "value": "d92357ca2e0ca95db655aa795ee333753b424603b7159744caa08adc3a6d9feb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97ff71e-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371263, "uuid": "820ae111-1d0a-40bb-b86a-0c134961a252", "comment": "Malware payload (Vidar)", "value": "005b848fe7df945b408a7f969b889723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371263, "uuid": "d3d3a303-cfbe-4145-9a34-0985374addb8", "comment": "Malware payload (Vidar)", "value": "d9aa1f8ac9e5ba5c35d217f5fc4fa9ebe2efc4f4bcbc20efbcb7f3f178fd645f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371263, "uuid": "22602ef3-71c5-43d5-a4e5-52fb35dda9a4", "comment": "Malware payload (Vidar)", "value": "1a51a4bbf8b4caedbdbdca74eda251d5a6f9d73a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371263, "uuid": "64d0359c-1046-492d-9b5a-5310aa7a4d47", "comment": "Malware payload (Vidar)", "value": "82de9171698208daf07c9e1a3e57437231d3034e1052de5445bd6bfc0c07db064bfaae18c68bf35fe91fefc469e543cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371263, "uuid": "c7cecbf3-9e61-4a53-b605-f104eeb7367f", "value": "T1214217C6B5D3E0BDD1A4C278DE1B16BBDA213096060E5BFF16FC924427C25267ABC908", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371263, "uuid": "69c91cf2-b8a5-4413-aa92-5bd2f646dff7", "value": "cf623daeb316fdd052c715e1828e1b00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371263, "uuid": "b85b5f4c-ec3b-4caa-bbbd-55660fb98620", "value": "384:OLySoV3PgmxFQ8W9bSdr4XWXLhsQi/krJLSlXe:9fhFWdSp5XLhsQi8raXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371263, "uuid": "ff7095a3-73c2-47d6-a593-d85d959c9212", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371263, "uuid": "583bc8da-0eb5-44dc-a16e-9d7f7de35c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371263, "uuid": "36fc3928-168b-4162-8f29-f006d1125f1a", "value": "d9aa1f8ac9e5ba5c35d217f5fc4fa9ebe2efc4f4bcbc20efbcb7f3f178fd645f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1532494-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786372135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372135, "uuid": "29e6888a-1073-45a9-b706-b273aa3ebe10", "comment": "Malware payload (MassLogger)", "value": "0dace8bac4b3d3c0c6140323d660bb12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372135, "uuid": "00115d4b-55ad-4081-a451-2874006f6297", "comment": "Malware payload (MassLogger)", "value": "d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372135, "uuid": "79ea4683-df0d-494b-ba42-e687f071a3e5", "comment": "Malware payload (MassLogger)", "value": "35421ee8fe5b43da7467be47a42313ffa3076874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372135, "uuid": "fed160a7-f1e5-46a6-a4dd-9b052fef138b", "comment": "Malware payload (MassLogger)", "value": "1baa4f9d8f0b90cb0de6aeeea5e79b09bb47edfc18721e49c47a4d6e4bce560c80f63641667178cd8388cd107884656b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372135, "uuid": "7a8b533a-277a-485f-8b39-de380ec3ecc8", "value": "T1680513B567BADB06D2AA8BF00EB1E1B153B86D9EE421D3428FD7DCDB74217245108393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372135, "uuid": "07bd3581-bf5b-48fb-a8b1-b869fec9e39e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372135, "uuid": "348a068b-5dd4-4e47-a53e-b88130d48c7a", "value": "24576:Gj/Og3FbJ/xzRlWdi3JjEYtbZTaiFjBLrvIXX:sPxJFH3NEEbMiFtPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372135, "uuid": "b7c382ad-1f33-4112-a805-04fafe339451", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372135, "uuid": "42213a79-5a6e-4873-9996-7e68314e589c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372135, "uuid": "13a882b1-3e23-446e-89eb-3af7d4ef19d3", "value": "d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330fd5bb-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "15a56e5d-7d00-4a68-8eec-3f61ce5ae92c", "comment": "Malware payload (Mirai)", "value": "6e94cacda97247d1c44f7c2cdbe17bb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "9f25754d-1baf-4252-af15-edf2396e6c3c", "comment": "Malware payload (Mirai)", "value": "da687e506f91e16bac8dcd54d6b2fc37457988e4faea1dd754c56285a338580f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "f60aa863-5d33-4336-9112-6c640b878a67", "comment": "Malware payload (Mirai)", "value": "cb017a5142b6d14d679b40886a144be60065a94f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "f026c328-7291-44db-860b-235f42dc871e", "comment": "Malware payload (Mirai)", "value": "503a36d22422ef47e4d8e5f50a11c8a59595a3dc6516605b6a26a07ef8ee89b96f72816d9385f870827863838584ec23", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "d49c919d-16f7-4b28-8a8a-ebf1c822aeb6", "value": "T19C142A56F8819F15D1C502BABA2D524E37231778E2DF72029D109F75BBCB86B0F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "6a17c53f-b563-4014-812a-713a8e5fd44c", "value": "6144:UmR4qlFRSMgBTWiMdsCdfyacqr/LrofAwL8WytT1L:9R4qlXSMXi0sCdfyacErofAwat9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356837, "uuid": "565da5c6-7e89-485c-9327-13a42cd6784f", "value": 208948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356837, "uuid": "6bb0c1be-9097-47f6-ab38-f6befef49234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "d329d3a4-ee66-46c9-96c0-98667a57d08e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931035e5-949e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786354421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354421, "uuid": "7d1d49be-51c8-483b-8eab-28ab05bb6e09", "comment": "Malware payload", "value": "cc9cc12df791325ffbdadea2df4b1467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354421, "uuid": "c8eb2035-6fe3-4ce1-804c-8d47645559b3", "comment": "Malware payload", "value": "da77adb9d58bec88067311fc99a10f716d8c7bf2843d6e6be15707fffecbf1b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354421, "uuid": "bf57088e-7011-4414-84b5-0893a5bd6457", "comment": "Malware payload", "value": "172891d1e8d22b88c2522a305e1a4261fb4a2eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354421, "uuid": "b56d1d37-061f-4dd1-b2d8-be5ccbb76433", "comment": "Malware payload", "value": "267082c23477ea3a4d9444a2fc7efc703913c665e800ee46027bde467454005d4f759117f0a33d556bd95e43ef264230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786354421, "uuid": "4876cf76-e7fd-4132-a30e-be506c470563", "value": "T16ED523A6BAB64974E037C7F2DE82E52DB0263B844B248E4735CC17115E27C985C39B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786354421, "uuid": "6f7d4bc6-bf31-4f1f-b1d9-d675adb8ddfc", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786354421, "uuid": "ce92a6b9-1a46-4b6c-9cfd-3f8a3e06cce1", "value": "49152:eY4eU9lC8+tXyWDKyQKgnvtkMGIpSPyv2N34HyHpBj/a2FKlIdYx/5JMu:e3eU9l5+1yWDFQKo1Iu2WiB9KQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786354421, "uuid": "99ba93a9-4f9a-4027-9595-eec7130a0269", "value": 3009536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786354421, "uuid": "d6765530-a4f2-4837-ac78-aee0baa508aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786354421, "uuid": "31d0e295-e9d8-4725-aca8-0d94fba6f8d7", "value": "da77adb9d58bec88067311fc99a10f716d8c7bf2843d6e6be15707fffecbf1b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df88446-9494-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1786350064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350064, "uuid": "f16b7158-349e-4715-8aa4-8f550d01d27b", "comment": "Malware payload (PureRAT)", "value": "0e260f328a81040da84f79bb21d54953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350064, "uuid": "5c4a07b1-9cda-48a6-bf95-e19e3430c9e6", "comment": "Malware payload (PureRAT)", "value": "da9442ac1174544216a00fb1792f7ee019cb708e47cd5948a9632e24285b36cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350064, "uuid": "6fcc07c4-5bd3-4387-9b07-0b7e1491ce9c", "comment": "Malware payload (PureRAT)", "value": "965974f7bb6bd5c71da7d0ae843ea3f84229b74c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350064, "uuid": "4921b5ab-7cc7-4906-b367-36d636a6cd0a", "comment": "Malware payload (PureRAT)", "value": "52758d5791790e9f9c30825a2908a1e7f09ea5bbce76da60ed85e34b137442aa0eba89f3fb802b59518b9048fd4684cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350064, "uuid": "f1dc7691-5147-48d7-ba86-6c69717d36b3", "value": "T18F941220B4C1A172D5B2867A1C75C971CB3DF6746F218DFB3788633D6A301C19A3A9A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350064, "uuid": "9e6c448d-35f5-41fc-978c-121bf136ad62", "value": "5c54a1d23a98e4d6843a01542d040761", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350064, "uuid": "8a8e8ec4-5c5b-475e-bbf6-54c9e70a860b", "value": "12288:DbpRJOeoKtyCLDNPUWmZoInQLFmXbTRJjnC/g+/f:/TJqKxN7InvXBJzC/gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350064, "uuid": "0c5754fb-768b-41a0-922f-ba3f5aaf59b1", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350064, "uuid": "768216cf-79c7-48ab-898c-d296b48a5874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350064, "uuid": "9cf917e3-8f69-49f3-9af3-7a2f57ddae2a", "value": "0e260f328a81040da84f79bb21d54953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f024b023-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371328, "uuid": "3869b9de-0c6a-42b1-a838-2dbd341a03d8", "comment": "Malware payload (AgentTesla)", "value": "83f412e872598e61f6f99fffd7878b67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371328, "uuid": "05a6737b-bb97-4a89-b248-ae03c7555107", "comment": "Malware payload (AgentTesla)", "value": "daba3f01e6f2ca65e4e6191621866daafbf3cbf5325d15ca3d9dcbf71d061ab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371328, "uuid": "dbc0a99d-57fb-4227-b1c2-47446d64070c", "comment": "Malware payload (AgentTesla)", "value": "aa029408da44349491731bad2a6bc726447ea820", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371328, "uuid": "6b647d48-1341-4900-a4b2-c49bb9d6e6e1", "comment": "Malware payload (AgentTesla)", "value": "990bb9f95aa2b2360fc6c957bc7a4a7eef0fe7eeaf20f9a9a43520dcd9a4cf6f339703a7607dae05fe24eda0a5d3023c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371328, "uuid": "8b84cdb0-bacf-4b17-bc51-5b85e32c92e3", "value": "T199551214A354E713CA9567351AB0F2B927B81E9EB912D7025FD8FEEB7932B024C14683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371328, "uuid": "ca436396-4a48-464d-aca1-0dcac5194c04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371328, "uuid": "c19945da-b31b-4c2d-9043-ee74dea12647", "value": "24576:2V/zGwRYf5DbQ5uhAvzEfCqF6Z5U+/+tOZem3x:EOfFb+XaCh9/UOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371328, "uuid": "440517fd-d68f-46da-a85c-4cfc6c456dac", "value": 1334784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371328, "uuid": "0f136642-a60b-46e2-95a1-d908d8427575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371328, "uuid": "ae1b269b-c2c9-4852-9ee9-39c333f889b1", "value": "daba3f01e6f2ca65e4e6191621866daafbf3cbf5325d15ca3d9dcbf71d061ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e27ce26-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371459, "uuid": "dd4d4069-6168-4f49-9914-3a8991b27396", "comment": "Malware payload (AgentTesla)", "value": "2d0f611628050dd17b74536a2b0d62b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371459, "uuid": "5ad197e7-fd83-4a12-9b3a-d824ed09c38f", "comment": "Malware payload (AgentTesla)", "value": "dacf080972caaf70a63552dd9dbd27ec2f8761a471e9d3ffada23c85fbaa3149", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371459, "uuid": "eb5ea398-a244-48da-a026-34c10465f345", "comment": "Malware payload (AgentTesla)", "value": "4df34335260eaa5ebe1320f52a7a61b483ef35db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371459, "uuid": "6af62df4-9838-486f-b2ba-a59f902df548", "comment": "Malware payload (AgentTesla)", "value": "5343ebf7289b4149a83d22e7b389fcaa3bf1e97ce12b8e830d17aaf15cde1a0970be257d662d0ab9a7802c853f74952e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371459, "uuid": "ebbfef9c-6239-4bc3-81c7-720b3ea74542", "value": "T118252298694AEA03CC9817390EF1F376527E1EDE2611E7579FE96EFF79389020C40186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371459, "uuid": "d95d6c29-7275-4d7c-bc6f-7297fc9d932b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371459, "uuid": "e82329b0-e5db-4286-9e62-698a2fc713c2", "value": "24576:6d7/XGz06ZLlaT4Rx7k2OdD4fkl5mq66:y2zVaT4RxsDtAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371459, "uuid": "d90f5c3b-89d6-499a-91be-76363611874e", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371459, "uuid": "50f86540-1314-4732-997f-d30620725db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371459, "uuid": "6f3c5a5e-5c3c-413a-909d-7b6b2c7c809c", "value": "dacf080972caaf70a63552dd9dbd27ec2f8761a471e9d3ffada23c85fbaa3149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6679167c-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371956, "uuid": "3476609b-81ac-4cb0-a2a5-c5245de88aee", "comment": "Malware payload (Vidar)", "value": "b439bdb21357fc08403212cb8de71bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371956, "uuid": "ffb93977-f71a-43c0-901f-385904b94df4", "comment": "Malware payload (Vidar)", "value": "daeb1184cd93426ebf3f8fece4298557966580a04083cddada95e28b0f447282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371956, "uuid": "9161e147-8726-4206-bce9-c9c1012f2234", "comment": "Malware payload (Vidar)", "value": "9c93061761bc5123eb4f663e273c54a81a5bf769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371956, "uuid": "8d91cb3c-9d89-404d-b046-ba822f79ef21", "comment": "Malware payload (Vidar)", "value": "c45af48b8f325645ff1605300709d350effffaa4d19d85f83f255bf95131db3c15865635e24b139c54fa8d8e511d5a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371956, "uuid": "ed8878cb-979a-432f-9617-55778d934508", "value": "T13342F9C1B4E6E2FCD04C827662A611BBE1B53C4403676ABF77C557986ED23503EB868C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371956, "uuid": "99337e8d-bcce-428b-a8c3-780e37576445", "value": "85b0aeb0d13fb5c7226c80e10830c4fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371956, "uuid": "9622cfc2-ef17-4dc3-9ed0-176c8e617f32", "value": "192:whDRNmDqvjD+PGTN/a2cv/TU7ZQSCOko7p64Z3LYRHR3VwxEjg:w/NmDY5a2w7eZQel7rcxlwijg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371956, "uuid": "3088364d-d62c-4361-9b14-1059f96e3d14", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371956, "uuid": "5f11a6f1-e42e-4db8-b38b-ff3f975fdc5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371956, "uuid": "915bb8fe-77e7-49c5-a0ac-d347223b75b5", "value": "daeb1184cd93426ebf3f8fece4298557966580a04083cddada95e28b0f447282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197c3a8a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786370968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370968, "uuid": "74162dea-218b-49b3-8d1b-9648035fd44f", "comment": "Malware payload (Mirai)", "value": "c0c053aaf186b63cee1265a9cf407df6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370968, "uuid": "5443a256-6777-409d-ad71-d242a0642380", "comment": "Malware payload (Mirai)", "value": "dafa3873caf9e75125ce79d6718ee998d6df3c00026f841c40b368222f2c20a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370968, "uuid": "f1a89d5d-5b20-4ecf-8f63-418f36a1dd37", "comment": "Malware payload (Mirai)", "value": "9331a625845695cefd3485b6fa3ac6482327dc51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370968, "uuid": "d64cf81a-c235-4353-bc69-e10a65f0e9f2", "comment": "Malware payload (Mirai)", "value": "c9f05c14356c6e8a25dc0fa11b3b1a4cc59361f4517b40d92b61f4be9666a2f3c123eab047483c998706d7de96d81397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370968, "uuid": "9f6507a6-6cee-4a90-ad43-9ea8c2a72d30", "value": "T10C040A41F8144B57C6C22BBBBB9F439D37335B1897DB3301AA24AEB42F8679C1E29511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370968, "uuid": "f167b11e-6eba-4846-84b8-72ad114c1f4e", "value": "3072:TDfwbxgOGFc4wKdEJER2CRtRFHSFXBnOOvzBGwoUZaErar/nHUXD:yxgfFc4wKiJopR1HSmOvzBGwoUZaEraK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370968, "uuid": "c81485c2-961d-4861-b110-3c14e24b9545", "value": 184928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370968, "uuid": "e86e3bca-0118-4821-8957-89919193e7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370968, "uuid": "ee590155-408e-4b41-a466-8b45e458e7b0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f457d33d-94f3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1786391092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391092, "uuid": "069fcf0b-caa5-47d2-a869-189418162bf3", "comment": "Malware payload (Adware.Techsnab)", "value": "d2bae5ac5db01190abcb7e1871ced85b", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "DarkStealer", "colour": "#852C09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391092, "uuid": "79013f4d-b473-498e-bfa7-69f47da67106", "comment": "Malware payload (Adware.Techsnab)", "value": "db47182b8ec350a634683f5dff8707b220790bf92374fafac76c16295734e173", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "DarkStealer", "colour": "#852C09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391092, "uuid": "4aac2aa0-3fe6-4eb1-ae00-647568cc3fcc", "comment": "Malware payload (Adware.Techsnab)", "value": "6097f8cf4b4f54ce07452007aafe9a87d7802c73", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "DarkStealer", "colour": "#852C09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391092, "uuid": "62276f4f-c12b-4bb0-a460-bd56881e7ff0", "comment": "Malware payload (Adware.Techsnab)", "value": "e8e7c3d646357b4ac64920371169784c12832f626474549217671a50ac9132997db774612eae1caf88dbf25d8330b97f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "DarkStealer", "colour": "#852C09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391092, "uuid": "12839715-8e44-48f5-bec8-8eaaf14ea274", "value": "T1F7F6330277880CD6D53262FA8093C6B897737D514720C68756F4BC5BFEEB6920D3EAA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391092, "uuid": "d0c04dae-a880-48bc-9170-2135c63674b0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391092, "uuid": "d09d13b9-ac72-4d8d-94aa-7d18593eed68", "value": "393216:k9kjlSaz0QMQnNN85vziqdq0dQJluIF3MnG3pl5nCJP/RKYPeH8YH:BJdPMQNK5vziQ9dQt3MGZnCSYex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391092, "uuid": "8efc6631-a6b1-4e3d-91e4-e8bfa6eaa9d3", "value": 15344086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391092, "uuid": "c04eaf8c-12a1-45b5-bff7-53cd4c9b3f3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391092, "uuid": "68c65c3d-f805-4016-b70a-c6b6c0343ac2", "value": "UNDERTALE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a4c0ff-9498-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786351948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351948, "uuid": "d077e7a8-ba87-4327-a900-9233444b58f9", "comment": "Malware payload (Efimer)", "value": "88d4e813d032cc2fc22a5fea687b1726", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351948, "uuid": "290b0b16-4584-496e-b887-074bfd5d94cd", "comment": "Malware payload (Efimer)", "value": "db9d8382d456bc3ef9073eba9efe5d506f740effc8da7953a50cb4736bd42f57", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351948, "uuid": "950939db-402a-4839-a869-81c3b164fdc0", "comment": "Malware payload (Efimer)", "value": "978c1587ea27413dd2cbd0ec10996896cbdabd3e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351948, "uuid": "a12f1482-b56a-465b-a8e7-6bfacba03474", "comment": "Malware payload (Efimer)", "value": "c74cd92f4cf1fa5e658ed3a29a0787c04a7ea42855a20a68de7150ad160ef48bfdeff47fa73ce4715931bf8e03de333b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351948, "uuid": "6289dce1-99e3-4421-9ab4-d85a2273dd5c", "value": "T1BDE633480AF012BDF9B3813CADD34595F4B4B4B7A774C68B0B6C4699AD572F08D3DA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351948, "uuid": "400a9801-7e54-4aab-af8c-a3b69af8649d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351948, "uuid": "5443a0df-f9c7-4912-a571-407172f82514", "value": "393216:BGm6E/tfedvkvG6us3XMCHWUjgcuI3/PGTAI:BGeovkvG6us3XMb81H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786351948, "uuid": "8f9b7e84-d999-4177-a466-4e2fd5fcc70e", "value": 14258626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786351948, "uuid": "6f2698d1-f5b7-4809-bcdf-c83ce71b57d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351948, "uuid": "d10f071c-afd0-46ed-808f-c3deeb575597", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6563e6-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786370436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370436, "uuid": "bee676fa-7da4-4463-9e15-8009e98fd961", "comment": "Malware payload", "value": "77a01550ab4e46b40eebeb677342a53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370436, "uuid": "33e9c93f-4e16-4e1a-9074-f5f7ab77660b", "comment": "Malware payload", "value": "dc23efecd226b5e92995b1b5f980548523ce3758add708c69308033aeacdd753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370436, "uuid": "f96674b2-9841-4570-8616-c69202a65518", "comment": "Malware payload", "value": "7b4bb5d4c2133783a6654ff2c462602cccd3cc8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370436, "uuid": "6de7fb9f-df29-4a06-870f-61dd6f1b7158", "comment": "Malware payload", "value": "ab67687e73ea7154abae631466905567275da5cfbb62e98227b41d51c93ca110a81d8d24db942224214e41f9432c56bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370436, "uuid": "6315f7fc-b117-4bdc-b3f8-303c05f56727", "value": "T19325F1255E8B3B84DABE5FB8C167189433F0D80BD2A6D76A6FDD01F49EA3BC1C915012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370436, "uuid": "8fe39dbe-d407-4a9d-ac7f-b199021e4280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370436, "uuid": "60c9e0aa-b75a-4ad4-a385-912136142dfd", "value": "12288:YSlttgWh5YX8kBzdG7oe9mxHewPrQjVl4NHo2agOIEw2GClNsfj:r750jhwH7krKL6HzLrEw2GClG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370436, "uuid": "0a8ff767-835d-4a5e-9f42-22011231259b", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370436, "uuid": "a1a13e4e-edb3-4c6f-8123-61b4a6f4d74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370436, "uuid": "bb5b3564-c469-4764-a1ec-7c61acf7e0aa", "value": "dc23efecd226b5e92995b1b5f980548523ce3758add708c69308033aeacdd753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b3ff42-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786345616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345616, "uuid": "7965a38b-78f4-42d4-86dd-9eb5dca4973c", "comment": "Malware payload", "value": "acd3b5a88fea49d7487df710dd510f11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345616, "uuid": "3ff5c724-5c2b-4d4e-a2d6-17ba684691ff", "comment": "Malware payload", "value": "dc52c6f54d4bcefd4c78ffab7bddda7f56142d893c22130446472e9ccd283772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345616, "uuid": "6bb2ddee-9848-4f46-8495-74f9905d2565", "comment": "Malware payload", "value": "1e4713e82754f16789a056a80a300db389f9661c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345616, "uuid": "43a3fa9a-c434-4023-8bfa-dae7579684ec", "comment": "Malware payload", "value": "3b983dddbaca23bece0a95d486f01ddd64c4f7c0d5cb9f7e22bd1eea144f3635affad49b8ec60d68dbb0acaba3dddb71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345616, "uuid": "20d5549f-16f2-456f-a33d-6d359ee4919d", "value": "T15F63CA49EB41AA7BC09ECF34897EC14B00953DB692E8432E76E8EE8D7B7D15C47C2944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345616, "uuid": "8a9d5ee8-48e6-4a46-8b06-ccc0b6a9da5c", "value": "768:TGbzmooNq7Y6jDwZ361e+OTHxFEdptklPkEqILVenhNgrjcSP6:VNqk6jsZ36oHTxFEhklUILA6D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345616, "uuid": "f0ffd470-1684-418a-9abf-1a3190d18a2b", "value": 72884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345616, "uuid": "f1220173-f6af-4bd1-9d5d-84367614afe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345616, "uuid": "f37629ee-790f-40d5-8b2c-0f943dd3838d", "value": "main.mips64el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685d89fa-9451-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786321278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321278, "uuid": "2cfed83b-fa4b-4d54-be73-56bfdf04ff3b", "comment": "Malware payload", "value": "2b3adecca1b94e59e4c37ed240f5ef6e", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321278, "uuid": "07811d8b-fd05-45b9-ba43-6720db1adbfd", "comment": "Malware payload", "value": "dc5422ec75cbe6a12f2788a310f2f487e1be22768ca7b0db5aae3f17b90b19e0", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321278, "uuid": "9b1392d5-63e6-4a96-bed0-1bd32a7e73b3", "comment": "Malware payload", "value": "9f724cbd9e6a661d0ac1a389c137d520ec0fcc31", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321278, "uuid": "843bf735-cec7-4358-a294-4a59b275a498", "comment": "Malware payload", "value": "f68f3895cf7af1cab30c19d4acc67fb981e6097cc74e240f8f67f9bc06e68326381007f8287f5ae92a35867c19743698", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321278, "uuid": "856494c9-4aa3-41f2-bf85-4eac41ebf2a7", "value": "T1F0D501383CFB502DE173FF716EE879DADD9FBA322606645A204503478B12A81EE5253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321278, "uuid": "0a4ac2b6-06e6-4716-a89d-8ee2fed17904", "value": "24576:5AylvdqEiCYbk4BueslzpixhdustgNf/H8vp12odD3dXEh6EO:582YJ+IxbC38vr2odKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786321278, "uuid": "37c8634a-1d85-455c-9912-154f97780779", "value": 2812928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786321278, "uuid": "16a757fb-a9c8-4330-af45-59c47a5d0da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321278, "uuid": "73adc223-c572-4781-9d93-4b67c0607c9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fc8a3d-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371521, "uuid": "d7461aa2-6f53-4f6c-9eb3-147a789c2725", "comment": "Malware payload (Formbook)", "value": "99ef3bc4cbcb6ad735190dd293efc914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371521, "uuid": "ce0a1fe4-15f8-443d-98cc-dc26d2b7e9f8", "comment": "Malware payload (Formbook)", "value": "dc5e97455d005da30720aa670a666d736a9ba7a6eb838295087014ebff5fab68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371521, "uuid": "090f40d8-424e-4349-9d24-7fd91bd0bfe4", "comment": "Malware payload (Formbook)", "value": "75d41d2327b546df286770031b082dfbb00b74af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371521, "uuid": "a6ee056c-af00-4ea0-921e-640da29697b1", "comment": "Malware payload (Formbook)", "value": "e0cd77d70eb04dd99e68e65e4511f784461887c882121138f1c0665b267264b4e8fa3714efdfe73d5a790f75d0ef2423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371521, "uuid": "fbbe7456-58de-4c7c-9257-7bb294db147f", "value": "T1AB25129D9544E907CA552BBE4971F2B81BAE1DEDB801E3029FEFBDDFBD316084414282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371521, "uuid": "fc0589c7-01e8-43a7-9ee4-800da174d37d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371521, "uuid": "3cf7a9de-aa40-41d5-a91d-6c54ec9b22a9", "value": "12288:YlJdbkMdnBUDAS0vwu8oRShoG022K5KO54dQy49OrzjmaOi6B4ndZvhtx9LQ6jFL:YeMk0ou8oYoGP2rqy4KzaE6Whfxojjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371521, "uuid": "1fc0e2ba-a52f-471c-8e91-7165eaa46b80", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371521, "uuid": "ae2b3414-86ce-4af6-8d85-a7771d3f2fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371521, "uuid": "856d1db9-032e-4faf-89fe-9bcb6585486a", "value": "dc5e97455d005da30720aa670a666d736a9ba7a6eb838295087014ebff5fab68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b47643-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371735, "uuid": "0d8e0f37-50c0-414c-9907-c2bab6d72eaa", "comment": "Malware payload (Formbook)", "value": "db8b3c951c4a23b7785bc6235ef360c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371735, "uuid": "b1044096-0d4e-4a7f-9137-e9366bebd834", "comment": "Malware payload (Formbook)", "value": "dc9e70fe7e3290997234caaeaff2bfcc424fac6bdb4ea04202501276cb00cba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371735, "uuid": "ae757204-e3cf-4c75-a4b3-57724c89cc10", "comment": "Malware payload (Formbook)", "value": "9295462fc649a9158e482efaadb1091508b9acc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371735, "uuid": "9b47715a-bbba-46c7-a530-e48785769954", "comment": "Malware payload (Formbook)", "value": "85224fefe656ec14751be6a7a1607908475e8feea276cedc6280cdf4719a9039098c3d09b5c3811cdec7ce5372f42df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371735, "uuid": "8f4bc55e-adba-4cdc-bc5b-eb99aea3f5e4", "value": "T10D2512486545EA07C45513748A72F3F916BE6EAEF811C2236FDDBDEF7A32F018904291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371735, "uuid": "fd556e7d-3f80-42e5-b814-3881094e9450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371735, "uuid": "59b2ba6e-431b-41ee-8487-6f95198fffed", "value": "24576:MEgFzXc1EVfStepmuLh4Nx5lcWT1ZRaCrlmgV33SYxTB:MvFIWVqt5u6H5lv1japgVnSYtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371735, "uuid": "a4613c9d-04ab-4e21-8456-5694fcc4760d", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371735, "uuid": "00600a82-f6e9-43c2-84c5-16f4b1a081cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371735, "uuid": "86c651b5-3ac9-4864-b913-fdd5ffa52d1f", "value": "dc9e70fe7e3290997234caaeaff2bfcc424fac6bdb4ea04202501276cb00cba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a784075f-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786374212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374212, "uuid": "40e9bbd0-29a1-4eb9-a6e7-bd1b3acc681b", "comment": "Malware payload (RemcosRAT)", "value": "e09c8429dcc48d9c96d682ef5d057a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374212, "uuid": "a9d71277-02f3-4ae6-b561-4042b08923cc", "comment": "Malware payload (RemcosRAT)", "value": "dca7c663779ee0921563e3a547fea4e391c682a85bcf4b06aac70146d57319de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374212, "uuid": "c31ec9e1-9b86-401f-a86f-cf4e8844fcf5", "comment": "Malware payload (RemcosRAT)", "value": "1784db05860ad33603ed9a9d1a4f430e167ca372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374212, "uuid": "a70b771f-0530-4330-beb0-9a9852d28b8d", "comment": "Malware payload (RemcosRAT)", "value": "6cb9ca16fa9d04082efa8b985d0441c59d71a0314cdcf56c1fe4fb54e598abf0e7a54998d1625022fecb72dba695c764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374212, "uuid": "0fc8f98b-27a7-480a-8944-a30f5bb539ea", "value": "T1A85513486B05E402CD8107381AB7FBB8136C5EAAF101E353AFDD7EEB793AB564D14252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374212, "uuid": "2ab3225a-be29-48ed-a046-50f255c8d88f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374212, "uuid": "43c20fde-49d3-4822-991f-2108dcabd2f0", "value": "24576:xeA9szQjtQlsOeRzs3rud3cXI58bFPfFbh23B1Hd/3wySSOMbqtSeZ:4UssQeOeRI3PhEtZChge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374212, "uuid": "3346c221-363b-486a-856d-fb81c7897ccd", "value": 1401856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374212, "uuid": "7b16fc1e-f851-4559-b1b8-27aeec6f1b1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374212, "uuid": "971f3fd5-ccc9-47d9-b3c2-cc92676ac1c1", "value": "dca7c663779ee0921563e3a547fea4e391c682a85bcf4b06aac70146d57319de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153ff1f0-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371390, "uuid": "6ed781e1-5dcf-4f74-b1c9-3a050324bcd1", "comment": "Malware payload (RemcosRAT)", "value": "4ccd20c59e7cd09fe1d45f8d7d2568af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371390, "uuid": "2fe006bc-41e0-4d3e-867a-910f62eedff6", "comment": "Malware payload (RemcosRAT)", "value": "dcba0fe71c7ad69e5218d4934349a9da4d02b93eb30a8d62a58dfcedd299f6ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371390, "uuid": "16941920-ab2f-470d-a5f2-4b3c87d0a9b8", "comment": "Malware payload (RemcosRAT)", "value": "dc0d0b953a2ae3f466cb3f3510ca1442a402be9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371390, "uuid": "a991fc96-4bd9-4b05-93f6-1f3099371adb", "comment": "Malware payload (RemcosRAT)", "value": "c53b2baa64030e31e2bf7d795bb3f579098ef327b71770ec5d3ba0baab61d6a707a17fb8894f09a5ac183bb4285493ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371390, "uuid": "27aedb4f-cb99-4b75-8a94-12c48a0acf25", "value": "T1E1651264B714D122C6852B7C5AE5F23652E92DEEB911D302AFEDBCEF7925F010D08683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371390, "uuid": "c66ff2aa-b982-4216-b797-244dad087108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371390, "uuid": "88ce5e78-8f2c-4a8a-81d8-7f43e8473b3d", "value": "24576:4V/ubq60yxQaYYGx22ZJCdx00CG/l4RthO5IpA1ndunAkO/29RVdeu7ZevPYaHEC:LAyxZJAZJMx007KRXO5IpArVyVdeu4Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371390, "uuid": "aa436bf5-c6ee-4dd7-9a82-f0961eec23f5", "value": 1422848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371390, "uuid": "d73dabbd-dd57-45a6-a3be-c3d49994da03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371390, "uuid": "1bf76a54-89fe-487c-81c4-037678c1997c", "value": "dcba0fe71c7ad69e5218d4934349a9da4d02b93eb30a8d62a58dfcedd299f6ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f051185-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373124, "uuid": "f3dff6d6-266d-43f7-a1e3-2c5e065c5144", "comment": "Malware payload", "value": "924ec01ff9fee68b110d4b57739fd241", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373124, "uuid": "baf5c8ff-7811-4436-b481-dee0541b80d3", "comment": "Malware payload", "value": "dd60ef07be5db65ae49c549d50f77b5487ea9ad9284d4707fdc16f3a2a767b37", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373124, "uuid": "3624f3db-9123-4e79-bd0a-d9881b1b9968", "comment": "Malware payload", "value": "f030a10fa382e76b2d7ef662b04d9303efe97c56", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373124, "uuid": "cb2f2684-3734-4bbf-b7d4-8406fb5d3f7a", "comment": "Malware payload", "value": "152f0e7e4f7b3e4c30410974c19ca8c620dc008f7a09b7f907f0a01e67ab7663be162b53efebf76b77a1283620e4185a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373124, "uuid": "a5a9bbba-80f9-4ec1-8bda-683ea0b8bc87", "value": "T1803207CCAF9062F4F29703DD27AF299D136561CB504CD880F68C6DE06F4B68D4A96E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373124, "uuid": "6936a2cb-f2e2-4eac-974b-ff1fc8ec5b33", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfMxBJULl9CX:sXX+/DV7k/3/lLAiYOpzExUp9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373124, "uuid": "961a5dbc-2856-48b5-b686-505a8ac6d39e", "value": 11932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373124, "uuid": "4c4c019b-a7f4-4bbd-b7e1-67676b1eaa8e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373124, "uuid": "8f1505b9-c272-4abd-98d8-8ec521698b09", "value": "cy4509Report.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0af76ed-945d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786326581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326581, "uuid": "8d54b985-eca6-4d65-9bc9-ff9219b1ddd4", "comment": "Malware payload", "value": "88a520dcd5cfd12657629f627386da49", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326581, "uuid": "0f03c927-9edb-458f-b5a3-b7f330b54e9b", "comment": "Malware payload", "value": "dd6350bd0ecef9c4803c039c581253cc95adf5efd5347097457e4f99318abc6f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326581, "uuid": "c0f78ec2-405e-43a3-8537-c22e08aff59c", "comment": "Malware payload", "value": "fd269813a1a4355d3bbe666de392c13cc981d096", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326581, "uuid": "593044b7-7cb8-4aa6-be7f-815018fe5af2", "comment": "Malware payload", "value": "952c37267bfe9a133a850a483631ffb9f7d6b14bc4ca2c63dee118c7802ee8840456e2bddc809c6362bece4dbcd0eb64", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326581, "uuid": "c1a74b95-2b52-4d58-af5d-f2560832c3da", "value": "T108C27D966A967C44BDC98A3E4CBD2B0D6DF5C3D1224942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326581, "uuid": "413bb516-1b78-4753-8eda-bf3ec237987d", "value": "768:C/E8vCB+25j6es8Rrej9FYpMSUpi+20qUpi+20YQX:qE8l25JrWd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786326581, "uuid": "2fa11c15-1814-4e19-ada1-ecac244f87e5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786326581, "uuid": "1b777591-409c-4cf3-b01e-f01f7867737b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326581, "uuid": "44d0b395-50b4-41b5-a8ce-b71adccf13b5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9998c9-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340053, "uuid": "0fe6ff9a-f2d5-4f70-9bdf-cbf32209ca23", "comment": "Malware payload (Mirai)", "value": "ce1e8c1b2ec175b4306f521baec6a0db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340053, "uuid": "818f6116-1a7f-4765-94dc-270793814bae", "comment": "Malware payload (Mirai)", "value": "de2b7468ad5e7e3811dc894696f41a7f5ab0e6cf43f90af413111f056aeb2512", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340053, "uuid": "b8c2e641-1140-448b-9d9f-4c03a1768feb", "comment": "Malware payload (Mirai)", "value": "bfc917da8acc544944482f4ed515a0abce092dc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340053, "uuid": "83f84783-0c2f-47c8-a59f-b6a0165cc61d", "comment": "Malware payload (Mirai)", "value": "141b9774c2e1a2509ae2d0d5dfc0391c2505371bf3acf6dd38970db9802985dbc62d9d961bc9f7e8e91876e1cd66b7c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340053, "uuid": "f22922de-ae1d-49ff-8532-ed232805a9f2", "value": "T10474FA8451F1E6DAD15CBD726332BF1A2F67093670D33146A09AE6FF329F18449AC9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340053, "uuid": "03733f75-5745-434e-a734-d58a18fd9c35", "value": "6144:iQOLKKCMRhtUP7dls57WAMVjVGNduzFOgKE1j8Zt7JWVJWbFd7bS6:iQOLBSjjs5kxVse9IxJWVJWbFhS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340053, "uuid": "7ce1abbd-80ab-4ef2-8e62-7ad542c5853e", "value": 364180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340053, "uuid": "a16ece6e-76a1-46b0-95c1-81cbc34b33a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340053, "uuid": "04fe86e2-34f9-4ebf-99c6-a064ea101ae5", "value": "armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6f384f-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373607, "uuid": "68324b10-eafd-433a-a47d-2a420fd6ee35", "comment": "Malware payload (VIPKeylogger)", "value": "1783551a3573c859184e25f93918650e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373607, "uuid": "afc37dc7-48be-42ef-9139-52db5d3c40ee", "comment": "Malware payload (VIPKeylogger)", "value": "de49bded1f27314b6ac58c61a6e6ebf13fe4e343a7005b32f67b0389984db8ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373607, "uuid": "42434237-4a16-44cd-b6d4-38053e2f05a8", "comment": "Malware payload (VIPKeylogger)", "value": "dd82f5e39e1e415cacc4600cb8fc660b55cc24a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373607, "uuid": "860e7c54-39f6-4595-a95b-125f444e888f", "comment": "Malware payload (VIPKeylogger)", "value": "bf2abd54486927259367b7b0c974cf4d88fdb6b98ca8e2798cbf64fc6b3e58ddef0c9551e814d2fdce6ed748400ba742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373607, "uuid": "2246ba54-4734-4033-918f-2fc259c22e91", "value": "T15E45CFAC3111759FC457DD718DA4AC74AB206CBB931BD20396D30DABBA0E596EE042F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373607, "uuid": "10a83cf9-0baa-4217-be0c-75caec292492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373607, "uuid": "0e55eaa5-147a-48ec-9bdb-2f487d01c948", "value": "12288:0Qu6mToqpEGQoU+eWmY2yPUfvKF6VY2cggwR8zYrCBe1JhMTB1jvRlRLY305CsGv:BubEdkUfG6TcggU+BO+1jplRLYPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373607, "uuid": "46cf2a8e-e74a-4dcb-b34c-a076e3d6251a", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373607, "uuid": "98630489-109b-4468-81d8-fa65db1e25cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373607, "uuid": "10a39b53-62e1-4dfd-8ec1-f2162e89aa96", "value": "de49bded1f27314b6ac58c61a6e6ebf13fe4e343a7005b32f67b0389984db8ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27580bfa-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371850, "uuid": "c4330851-8afc-48ff-aba8-0ab7dcedd09c", "comment": "Malware payload (Formbook)", "value": "578dbd6fd92b8eda2e10daecbfa1d6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371850, "uuid": "529bd3ed-cd9d-43ea-a417-b577d2564e8f", "comment": "Malware payload (Formbook)", "value": "de6a2e9332bae391df70668839d5da718ca45310bf89f6f85179742706c0e015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371850, "uuid": "4ba3dd85-f2bd-4b2f-95cb-0b677cf486bc", "comment": "Malware payload (Formbook)", "value": "a515c8b9e4fe8e61a0ce6c3db6f4df0ef155d21d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371850, "uuid": "fb67697e-a3a1-49f7-84f7-c4de004f0dce", "comment": "Malware payload (Formbook)", "value": "57188f7762de3784a326fb5e2998155361e4fbf592954691cecc00e8fbedee630f275e267787e3a2a65d40a00feaae6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371850, "uuid": "214bcfda-01df-4dce-b9f6-a5f1e51e5718", "value": "T17F252259761FC903C8954B384FF0F13827A95FD9B802D22BABD92EEBFA627550C441D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371850, "uuid": "fcad5d22-e096-4f38-b97e-8e8b21defe67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371850, "uuid": "a90ed804-50c1-4ab4-a2e5-51679c74f007", "value": "24576:ptQtDS1Vbw6IrWN952IFyPYdcjgcuK7i4eTKve:YaVbwzoFyOZcuKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371850, "uuid": "ef479c06-5694-44a7-a3a2-0aab452d7016", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371850, "uuid": "7bfb36e9-6846-419c-a0ac-08b92dcfd2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371850, "uuid": "a5792997-277a-46df-9e47-1c48199fd79b", "value": "de6a2e9332bae391df70668839d5da718ca45310bf89f6f85179742706c0e015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea2e40e-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786348347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348347, "uuid": "c5643bfb-f8b6-4e74-a827-5006f265a766", "comment": "Malware payload (Efimer)", "value": "662d653f550544643f67c3891ff2cf2c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348347, "uuid": "b8f13e0d-a05d-4d6c-9d43-59d184db6a96", "comment": "Malware payload (Efimer)", "value": "de71cf8817c3e91c8a00c22198bb36d6655f00e32741098ae5d81ec09ea69918", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348347, "uuid": "44c3d6f7-c2d0-472d-9365-2c6eaf929a7f", "comment": "Malware payload (Efimer)", "value": "5df985e256e32dd57aaac1bad79672fbb44788ea", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348347, "uuid": "77eae444-9c16-468c-9310-8503bfb4b821", "comment": "Malware payload (Efimer)", "value": "e9ea18bb75eca6f55112439903c2e63f0c72c6a8e762637d196bd8196b2e55aa67d9f13191d4e761e1deff60692adcf7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348347, "uuid": "bd5334d5-0662-4564-949c-c575a1b1dc30", "value": "T1E9E6330C67C110FEEA37947CDA920652E576FC950731CDAB479886A62E573E08E3E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348347, "uuid": "972d6df5-6662-4d1e-9195-e62ff9a4c8c6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348347, "uuid": "0b6a035c-5bb2-4794-a061-e4cda55fede3", "value": "393216:yGmlNrk2vR60JJLeUbuZ5TntXMCHWUj6FcuI3/PGTAI:yGErk2Z6iJLBb0ntXMb86yH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348347, "uuid": "80c1073f-b6a0-4026-89a9-b7188ee8c1c6", "value": 14290976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348347, "uuid": "753d153f-a659-452c-8629-29fb0c2df1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348347, "uuid": "7351f49f-3282-416a-bdd9-034d86560430", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8f01e1-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372741, "uuid": "df57e916-6188-47a6-b841-6c2151a9edbf", "comment": "Malware payload (Formbook)", "value": "e6d99ad82603d68dbed6a329be10fb5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372741, "uuid": "6493bc3a-4489-4277-a9c6-5de926883502", "comment": "Malware payload (Formbook)", "value": "defb4d790fb9778284b47469093c0a57c156dbe93cc024356e92f6116987c27e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372741, "uuid": "5a91f848-de05-44b1-9e6a-a3bfde79e424", "comment": "Malware payload (Formbook)", "value": "f1176c26e41ea4e9b2c270173a43432189d02fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372741, "uuid": "845b1a7e-7a5c-4858-8a5a-b158405d88f3", "comment": "Malware payload (Formbook)", "value": "83b32bae61c02e3e0366050ae4dac16aab9e5ee613533c01b234c339628f93241ab4a87213cb9c4c2abd962a49ab16f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372741, "uuid": "41a5c144-d8b5-43dd-87cb-1ddcd233fa10", "value": "T15F35F158165BE842E1D587B7F8F0D37433A54ECFB9D2C38A5EE92FA3791A7C20590181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372741, "uuid": "67aec185-f2c3-4f64-852a-54b8db9f4417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372741, "uuid": "1c5f8745-29f0-49d5-bdf0-0d55ccb0ce63", "value": "24576:Lq0jdkp50l8s+9A1t3Nl7rGPhGQw+eH7L15rdirrO+Ecr99JNaBYCmX:qphB9Gt3THGkH7PQrFEY9JNye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372741, "uuid": "bd45c180-d196-4710-8576-cc7e483b62e8", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372741, "uuid": "14afbff8-f9fa-40ee-995e-2a7753399ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372741, "uuid": "dec61ac4-d43d-4ef6-9cad-9d8eb9b56313", "value": "defb4d790fb9778284b47469093c0a57c156dbe93cc024356e92f6116987c27e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79675114-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369411, "uuid": "f4328ee6-001e-4112-a746-e2a222a7ffdc", "comment": "Malware payload (Formbook)", "value": "f597105804941caa3969ca128dec09fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369411, "uuid": "069415ab-9805-4b2a-b47b-c7cad497c127", "comment": "Malware payload (Formbook)", "value": "df064d574f17f78f96c0f01caff469235dd586a3b95c4acc3a7212b1927aad1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369411, "uuid": "cfbe2d12-1153-437f-a66b-4a797aa7f9da", "comment": "Malware payload (Formbook)", "value": "4f29ef5bfb042d56d9301516f0357019eade49e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369411, "uuid": "122cd9a0-7fc2-4cce-b46c-fae4845253c1", "comment": "Malware payload (Formbook)", "value": "c09db2905432c35167f85ba979ead94c2e048bb05fd0cd5dc8e45930ee9390e3affcea7bbc8f8bffd54b009a54966c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369411, "uuid": "d8fa8ba7-c31e-46ae-b323-0179e9272bbe", "value": "T184350208A7A8DD03C42E57786974E2340BB55E19FA12E3135ED4FEEB7C7A7229C05287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369411, "uuid": "9e6e03f9-a3b9-48ff-ad1d-67e6ddfe8599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369411, "uuid": "49d34bea-61b8-486d-8eb6-ba89c2ff7c5d", "value": "24576:kAHvV0LIXT/nqH30BcSz35fS4u1A5Bmb2VEoi5+N34++Y7L:kAHN0LWnQecSzJa4fVjV34+NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369411, "uuid": "d95d76b2-65d2-4c2b-9743-ba46be09e5bd", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369411, "uuid": "3d207b70-3704-44b1-ad59-51dcbb542b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369411, "uuid": "b1ef66b6-6ff1-43d6-bfd1-1c561950b863", "value": "df064d574f17f78f96c0f01caff469235dd586a3b95c4acc3a7212b1927aad1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b232201e-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373371, "uuid": "4048f0a5-33ce-4df3-b70c-7a2cd49dc6da", "comment": "Malware payload (AgentTesla)", "value": "ced9fafc1f4156e5a033490b7c419273", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373371, "uuid": "0f539c91-05a8-490a-869e-2b734661e649", "comment": "Malware payload (AgentTesla)", "value": "dfb247897c1ba7bed13c7993bfdb60dd49aea33c5e724db556b2991863b3969d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373371, "uuid": "7c132f61-d6f7-4248-abe5-bb47309d8ac9", "comment": "Malware payload (AgentTesla)", "value": "7f2859c127ab1d05dae47e08aa9e2d4c4ad251fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373371, "uuid": "ba5e8cb7-fe20-401d-ac64-c6e25856b14b", "comment": "Malware payload (AgentTesla)", "value": "950f395be1b76c3ab8b016c0237008c6bfe29fbc238c6b2b66e33be72f48d8077812e3954721949de361db9af96f5f28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373371, "uuid": "b5ae4a6e-9a64-4ae9-b8b3-8331cfff8e2e", "value": "T1EE3501441356CD42E0E68BF6B970D37472754CDF7AE2C2869FE96FF7382E2811958282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373371, "uuid": "c07032a9-42a4-40d1-a199-5d95dbaa36f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373371, "uuid": "7a7b5e8f-f678-417e-afd8-60f8c51d6896", "value": "24576:ip50Dxt6hS0uDRcAJMErroJmZ+DpwUPAOA1ff:ip1WDRc8ME/WmZYpwU613", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373371, "uuid": "038d4515-25b8-4f6d-987b-29a3907c20a5", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373371, "uuid": "7daf201a-f194-45e9-bc21-cd171b50e119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373371, "uuid": "8febb132-bbb5-4e31-8336-d5e2ce34a701", "value": "dfb247897c1ba7bed13c7993bfdb60dd49aea33c5e724db556b2991863b3969d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ed7001-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383660, "uuid": "659551d4-7832-4cd1-8a3d-0d164c1da7da", "comment": "Malware payload (Mirai)", "value": "5c15785ed82f51866c4fa6224bbf0718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383660, "uuid": "f2b2fe77-f5a7-4741-9e83-8da0826d9f23", "comment": "Malware payload (Mirai)", "value": "dfd5a6237aef39a63ec90c0054b3ab4da38c1e2650167d26b8d0c4c8e0f8fd74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383660, "uuid": "48fabdf7-3bd4-4914-b58f-ce545f101de2", "comment": "Malware payload (Mirai)", "value": "2da72838388398a5b376f012bfc260544be1cfb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383660, "uuid": "c41eb960-cead-4c3a-a233-63e5159ecc90", "comment": "Malware payload (Mirai)", "value": "1e870d2482fda653412349885f4a98475f97e5643d8e38e0364e57709411e408cc5d5097ee4e311fe6d1f64a3e97ae91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383660, "uuid": "936f8190-8f89-4988-97fc-9ba2f75a3d76", "value": "T14FB34A03B56480FDD0AAD17087AFD137EB32F99512307B5E2B807E612E26E165F1BAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383660, "uuid": "10267f77-b764-4bd4-9ce4-4d34fe183329", "value": "3072:nsZWv+LgJjAFyoW6u+LnOaaLoVrLNCrs5e:ZAY6uinDaUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383660, "uuid": "1c8f0d33-8035-4ad9-a034-b1337fdcc111", "value": 116856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383660, "uuid": "5a508069-92b3-47d3-9354-c53b384b5cd9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383660, "uuid": "e4ecf308-c5f5-4f2b-bb5a-07b6e36e439d", "value": "killbotx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ee431a-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327715, "uuid": "5e6a67ab-381d-408b-95f7-a07888ed7147", "comment": "Malware payload (Prometei)", "value": "4fd7f470101385e2e2f3a35fc62e6d6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327715, "uuid": "f2af1c77-f5a0-4850-8578-b1000eba90c7", "comment": "Malware payload (Prometei)", "value": "dff3fe8edc2b6c29114940240e91e236df49a395ae7a6424928c0bd77259ae0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327715, "uuid": "ab9ffd29-4091-4ccc-bfe2-b80c02cfd7a7", "comment": "Malware payload (Prometei)", "value": "265ff1b6217cd0060595aea61221c9f58f55ff16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327715, "uuid": "f3f1fb89-dc7b-46d9-92d5-8ddd2e085094", "comment": "Malware payload (Prometei)", "value": "19be25e2b9d0bd2422567e843cd45ed05e0ed906a7368373affa075adab7d2b0275cf3f5d0672ae1b61db8309df03276", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327715, "uuid": "9df9847b-4936-421f-a218-5e74e9984be1", "value": "T1E99423FA1A8EF3FB49127F7027A0980081A47470F99D775986CBFDDA0FA52679CC8108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327715, "uuid": "fc5c70f7-d540-406b-bab8-018474d85f71", "value": "12288:Ka6aYYIX2dWVxeJAaLYxAOfUhjXb44UfhlBeSE:T+2WejYxUxsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327715, "uuid": "8c6d2faa-de8b-4c5d-93e4-de7456eb630e", "value": 428374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327715, "uuid": "0aeb8cd6-2fa6-4728-9a28-da4045278136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327715, "uuid": "be2e3d59-eaa1-429c-9586-421ff2383e67", "value": "dff3fe8edc2b6c29114940240e91e236df49a395ae7a6424928c0bd77259ae0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4854190-94d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786376033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376033, "uuid": "2c6f5d09-118b-43d1-a78c-972a0765c044", "comment": "Malware payload", "value": "f43fe56c09bb7265ce251d993cde07ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376033, "uuid": "1d2d6dbb-8f53-43e5-9c53-f0cb65415c43", "comment": "Malware payload", "value": "e0108ae47d249c7764fc6d177cccf08bce5f8608f20ad79745b5ef292debb44d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376033, "uuid": "cd5fecbd-2214-48ae-8841-0a85de63b78f", "comment": "Malware payload", "value": "8fddedf18709f33ade5b54677c11b4321572cea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376033, "uuid": "6810f713-43ac-40fe-a6dc-1a9beefe28b8", "comment": "Malware payload", "value": "9a6dbb39be24b2b4c294431cd0a3601692be2352e9cb2491242270f6f8a46104a196a7671203c7342da090928cbdcdf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376033, "uuid": "3ca4d24c-5767-4245-b08a-e6cf564972d3", "value": "T1D2D5239DB9F228B8C837C776CF83F82DB02577540A704E8776CDAA409D629846C3A775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376033, "uuid": "1f6ff80b-98af-48ee-9c71-0b084dd84710", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376033, "uuid": "0556d229-7330-4f4a-b271-4f1225f2b668", "value": "49152:hTK9GbsD9kZ1RNBS4cYMKivMDlNvbMAbjjgaInlA6SPSsm8d7QUwFYbS8X/FK4MW:pbZzpHhZw6g5nlDCc8d7Q9YJLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786376033, "uuid": "336c2ee8-4cea-4d28-90a1-7f2513f943a0", "value": 2954752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786376033, "uuid": "22b61e29-a77f-4eac-9f62-b3989c139d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376033, "uuid": "e8516b5a-e83f-4478-8742-3bca30ee3f33", "value": "e0108ae47d249c7764fc6d177cccf08bce5f8608f20ad79745b5ef292debb44d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ee9306-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786345615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345615, "uuid": "b5882ad2-79e9-46f1-9dde-32c374e670c5", "comment": "Malware payload (Mirai)", "value": "5127fdf234e3ddfaa4cc0640973ca90d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345615, "uuid": "22c6399f-5048-4266-b3c3-d3776beac6ed", "comment": "Malware payload (Mirai)", "value": "e0cc4f8ec0d1de74aa8cb49987e58c351e3be2a45b974896ec15124150bd5d00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345615, "uuid": "9eac953f-4ea7-49ed-b204-d981deef1d2a", "comment": "Malware payload (Mirai)", "value": "93fb20770ed7a72771d7242848111b64fe33b547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345615, "uuid": "0aed270d-c98d-43ba-98af-79d4d480b7b1", "comment": "Malware payload (Mirai)", "value": "a46bce3d6cb20441e6ed3304878d186d83495d7c62777bccf143e322ecf8a2af618b07dfc4d1de64db1e7ae9bf78dc2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345615, "uuid": "7634bc2d-2ce3-4fd1-b2c0-bcb8cc21ae29", "value": "T165230998F844D634CBD475FAF91E43DD33120FA8E2E671118E21AA313BB79194A3B953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345615, "uuid": "0780f8c4-77e2-4478-9fa8-d356712dea6c", "value": "768:DSM5mkJQ4U01MQZKXCWbqWDWoklB4s/N3y4OB9BObwizWfzN1cA+L2KZztSw:DSMAkJ2QLWbqWDWok7713ybBK0XN1/+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345615, "uuid": "3f3b098c-e00e-4f46-a349-a331b31cacca", "value": 45960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345615, "uuid": "84b31d8a-6dd6-46a9-92cf-3598001542fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345615, "uuid": "a51ba3dd-fce0-4737-b924-f43606f88b22", "value": "main.armv7-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe57615-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368240, "uuid": "8a910271-75ad-44de-ba52-b090bf101843", "comment": "Malware payload (Vidar)", "value": "7988677c9c5881a03c23b97b2264d66c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368240, "uuid": "be7e4d28-0256-4941-a0f4-ca0959a8ad63", "comment": "Malware payload (Vidar)", "value": "e0e5cf766a1f5efca8484aa2a6543b37f254ba6bb37edd15276f93d81619e214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368240, "uuid": "6f4b0da5-2afa-493f-ae10-00eae69a0108", "comment": "Malware payload (Vidar)", "value": "0f1539631864e21edf196908452cb58aae9a7bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368240, "uuid": "a4037c4c-6ed8-410d-9ff1-8a8db29f2428", "comment": "Malware payload (Vidar)", "value": "67c1710a497996bb46d8eda6813709240ee4cc96bc231347ab44e15262d4c6bc46fc0ced1b0ba9ea2c1cdfae06a81182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368240, "uuid": "21259918-6fef-401b-9a69-c5b9e0490895", "value": "T1DD522C8A7292B1FCD2E9D37DCB1A2962CB35308017056FBF02EDE65477C2611B0B9794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368240, "uuid": "6ec2748a-33d4-4c02-b948-c798823cad1d", "value": "1599d6927d08f88e02098ee396f7c0e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368240, "uuid": "97de7145-5599-4651-b1cf-6adfef115b74", "value": "192:Oyj3yzG3oTJ1o5t75hFHpLiV8k4OGI3hnq9VVzui/OPFwUFvdC/53VJ:Oyj30TMDd4D4s3hwVVzFmNPFvdCBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368240, "uuid": "14d3323f-fc45-4699-9c68-6253d5305cad", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368240, "uuid": "7f10326c-392c-4b3e-bb56-64b45fd01ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368240, "uuid": "32be1cbe-9dd8-480e-a451-4871628672d7", "value": "e0e5cf766a1f5efca8484aa2a6543b37f254ba6bb37edd15276f93d81619e214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea9bace-94b8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786365581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786365581, "uuid": "b065d13f-bef9-4158-95fc-113dc11c504d", "comment": "Malware payload", "value": "66665dfce3cfd36f2db39b0c4e49ef1c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786365581, "uuid": "b3df78a9-40fc-4b4a-84cd-9f966dfa3a90", "comment": "Malware payload", "value": "e1108d6bcefd18c22279fcf97218190d3906fe191fce64047463a4ae61dd0a73", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786365581, "uuid": "b00c16c2-f7b8-4d3d-ad40-538627cb32a9", "comment": "Malware payload", "value": "a022fbbb29c194da7fa897b05708541cc4c6695a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786365581, "uuid": "7e94d9f7-8dc4-4e02-b57b-2010e3b902ad", "comment": "Malware payload", "value": "55dd47407a4bf062f987fee29cc1a3a4fa71d555839cc5421023af3c8b5ceaaad197d52dbf4c3199b37d9addb5e043fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786365581, "uuid": "461e3b9b-257d-4d4d-9696-ebe18a5f6fb5", "value": "T152017BE9E8D284313B0D843B550C59D9F606182F04F82D98A15DAD725F1C56877AAB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786365581, "uuid": "c6c96d80-e2c4-4801-b5ee-8b40b266ad0e", "value": "12:ZBzvetRjWr5jWijW2FGR7jN/OQaC5haHHYXqiCgENDNaQ4VBF0soRE5YEmYXmY6g:ZBzmtRjWr5jWijW2FGtjN/F5haHifMDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786365581, "uuid": "40026cbe-cc6a-4824-8f90-a4bb863b60a7", "value": 657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786365581, "uuid": "9fdffce1-b41a-4dd2-b389-1b99c4c69656", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786365581, "uuid": "55c0bd44-8681-49c9-b6fa-73cb56232548", "value": "dlink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce110883-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339917, "uuid": "a509ef38-9fff-4849-b5cc-f08217e9b715", "comment": "Malware payload (Mirai)", "value": "fc00a189ff11c3e843bc9aa00000b2eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339917, "uuid": "4d5e7e21-1eb8-4920-adf3-658c0e8e7095", "comment": "Malware payload (Mirai)", "value": "e135eeba5a712fd42d397ff4ccc2e532475fbc914b0923e72a053d134a8b0736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339917, "uuid": "fc8ad744-c837-4818-a1b8-63f761680838", "comment": "Malware payload (Mirai)", "value": "ee18722a49ffe053c3b6b5223e6d7ff9faacb8e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339917, "uuid": "a40f7bf4-16b4-4039-ab67-e007bb9d4625", "comment": "Malware payload (Mirai)", "value": "e1bb673d3791a0df07f2e044c5b46a13d708fee71e7ac7f91f88dd5aa56d693a6558f9310b26c943fc7b2dd749360c2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339917, "uuid": "a5c51d45-42df-4981-86ef-1f94321e6b65", "value": "T1FA843A88B2F1EACFE154EA755220BC2A4D624E32359371C5B19FFA7713B729009ED970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339917, "uuid": "2d5e8f9b-8db3-4644-af50-05a7b3909885", "value": "6144:cb3xH7qNqQaN8zfTnww5GtLRVr9LQv0E+XEHLa9emza9La9M:cjxH7CqQ4DFVr9LQv9a9eea9La9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339917, "uuid": "d4ea8852-e439-4601-a105-56b77f834060", "value": 390516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339917, "uuid": "cbd4e3f4-e8de-49e1-9dfe-925f0e297fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339917, "uuid": "05e72eaf-775e-4922-8be3-1f92969b3b63", "value": "pid.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04923a9e-94f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786389401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389401, "uuid": "b298a2a8-74d2-47a9-9b40-620a2335f178", "comment": "Malware payload (Mirai)", "value": "60fa9b8bb3264ffb0e0ae40c6f53e2e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389401, "uuid": "3264d33b-2439-4a36-b697-72a9ec47f7d0", "comment": "Malware payload (Mirai)", "value": "e14836b7487d01c91a97fcd5cbb4b8cba4abc13479f29fbf49c940c2a6d06b87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389401, "uuid": "9852740a-b2c0-4765-8584-68d0c2d55c8a", "comment": "Malware payload (Mirai)", "value": "a7ac1d7377ca94cf0193e778dd4b10c7e25ab279", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389401, "uuid": "24044bb9-6fc8-44f5-af92-e7d743a9bdbf", "comment": "Malware payload (Mirai)", "value": "d752fb14c7a27b96546d1cd67eb721c7c0db430d51f26654b6f009ce5f139e08cedc6825bd5570a8cc0080a50602aac5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389401, "uuid": "6e042501-f1a4-432e-b0e2-51a389ae15c9", "value": "T1253127DE04242A710502CE9E77B23648B28DE6FF289FD7D4DC080DBD525878DF151B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389401, "uuid": "6cde053a-4cef-4474-8e33-ee17688ed7a1", "value": "24:juqwRa0+ku5cy/oRQxHnEmR06tQtdCn6WYr1:o+kDPRgHECtACOr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389401, "uuid": "49efd5f1-a6c8-4ea5-ba5c-2dcd854d64b7", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389401, "uuid": "85ea8966-50d1-426e-82a9-81270d926e63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389401, "uuid": "43731875-2a5f-4c9a-81dd-ecc98c99730a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8292497-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370348, "uuid": "21a9bba9-1e2c-4874-ba8c-5468d5020730", "comment": "Malware payload (Vidar)", "value": "82f55e5a0676552a1bf2809ba3a6be7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370348, "uuid": "65c94755-aaa4-4744-9cde-a6f718b279d9", "comment": "Malware payload (Vidar)", "value": "e1593bc0154db55f207f6882e0f7afb6e682b2059fc9993318acef9010f7dcd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370348, "uuid": "bff65753-0b71-43e4-96d7-a54083cdb865", "comment": "Malware payload (Vidar)", "value": "1d10135245037917f7c8df758f72c64101fc399e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370348, "uuid": "c74275d9-8758-4527-b77d-9ce0b21171a4", "comment": "Malware payload (Vidar)", "value": "8a1fdfad8f88a2765e892b7bb0afdcb9bed151783fa1b30fb7248a509e63df1b4964ac7231961f1e6b558d5c64a16bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370348, "uuid": "718b458f-12f7-4b61-938a-d25021fbaeb9", "value": "T1C9521BCAB197A0BCD15CC279C7DB1376CA2630C127296FFF6AE8859513C129179B8E14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370348, "uuid": "3f6e83d2-76a6-4030-9572-4dc6129bc846", "value": "f6372b356b11b44f58d86bbbe9d55263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370348, "uuid": "07fa11c6-b232-4adf-8525-0b03c4f98678", "value": "384:+uTIGBc3MVxY712Glnetih/HBndnX/lwK:+yIGBccY712ptiv/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370348, "uuid": "cdf8f76c-bea9-47f2-aa53-f8570b149bcb", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370348, "uuid": "e028c59f-e412-47f3-b8f1-9363b47f144a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370348, "uuid": "5bb8538a-9541-410c-996a-ed5ad434b443", "value": "e1593bc0154db55f207f6882e0f7afb6e682b2059fc9993318acef9010f7dcd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03f70c6-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371301, "uuid": "564d2e66-6196-44ce-a276-c68b6d152f31", "comment": "Malware payload (Formbook)", "value": "cdb901f5bf5bb4239d6aae5bdde7fef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371301, "uuid": "0188ed96-0b1c-4a72-ba97-5e958dab5f35", "comment": "Malware payload (Formbook)", "value": "e1830429d29e6d8dc4c994feccd9953bd2f2761811c855a33c754776b5f6572b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371301, "uuid": "783cfb1e-ac64-4904-8845-e8660c2a627c", "comment": "Malware payload (Formbook)", "value": "c77c48b6a2ae4d6d6447db1e72c8a62c3aed6e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371301, "uuid": "e45b3cfa-21b5-4234-be55-cd79fdff29d3", "comment": "Malware payload (Formbook)", "value": "c090ef7160121cf34149dc6930046b7f40a48f219fa74d52484238ae711d1bee6e3995b29fba3bc67ddb961c55ef453f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371301, "uuid": "21a0b452-1e59-4f30-9a37-d93b1a662c18", "value": "T173451214A315E606C5816B38DAB1F2F603F95EEDE801EB538FD9BDEBB836B414844352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371301, "uuid": "9615642b-4b1c-46bc-b8bc-e409537a9e32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371301, "uuid": "39201456-22bd-4bb3-9a42-20648e3ea521", "value": "24576:sV/MwmWFFQeswgKEoZ6pPVCX0pXyRrbDLnu8tsbO/G6:5PW/LEbd4rbXnu8Kbi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371301, "uuid": "da7bc517-6cad-4263-adf9-a122b7bf466e", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371301, "uuid": "7a1aa81c-c8e0-4ad0-ad40-c8c7f1427329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371301, "uuid": "76b97fc9-c049-442e-8999-92b263b854c5", "value": "e1830429d29e6d8dc4c994feccd9953bd2f2761811c855a33c754776b5f6572b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad2080c-94fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394243, "uuid": "e7d1bd64-d819-471b-9303-34d4065fea25", "comment": "Malware payload", "value": "7febdc86c3b75435e5b108ca8296883c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394243, "uuid": "50617a5f-34ab-46c4-86ff-7cc187cd9625", "comment": "Malware payload", "value": "e1cf755023004130b21481bad35d5b6b1cc6f1cad2c9d675b42714afb6490613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394243, "uuid": "ddf900e4-2467-4d15-9b68-01c8d18f8894", "comment": "Malware payload", "value": "eee4cb735dfec5ef8b696f557348387ab9e962e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394243, "uuid": "3f3f5713-66fb-48e0-9d56-31641c77d2b6", "comment": "Malware payload", "value": "8971db9f453ac002f310315a87fec85d6f99be62dc7d17a587894dcce6231303aaec54cb741a50a44b29c18a968a0a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394243, "uuid": "a4a8c06a-e939-4661-baa9-0e81a052e6c4", "value": "T1B8534B11B348FAF2CE902E306081D1B4534E2CE2078669E6E54CF6E57D7361B7AAD76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394243, "uuid": "c50202bf-9a3c-44c5-8e4a-1ff37be5fb86", "value": "1536:koMaPo07hwCVy2ZHhi6uIhpq/nv2KuLgVqekOs/MwkX8rH:CaPo0wCVy2ZH46dyv2bGqekObzUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394243, "uuid": "e5a8c566-3c7e-465d-a8b9-4c4fe8d5400c", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394243, "uuid": "8b1b0efc-1b7b-4f74-aacf-8830f6081d15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394243, "uuid": "4db607f9-a216-4689-89c3-eb3ad5497db6", "value": "main.sh4aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00828ef9-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368349, "uuid": "13d3b47e-56a4-4062-a0f0-513df8952bf6", "comment": "Malware payload (Formbook)", "value": "b941206e01c0e4b42db39bbd92b3270b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368349, "uuid": "7792adf5-d67f-4782-b9ec-8443f788d01f", "comment": "Malware payload (Formbook)", "value": "e1d1541728b05edb65f174a01f5e0312a203fc4579295fc7ddf085811af4a2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368349, "uuid": "67441439-a19d-48d3-b906-f203d2737cf2", "comment": "Malware payload (Formbook)", "value": "ef83b5158085a19827a995fc14810758c1c3494e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368349, "uuid": "a22c7aa2-4e7d-46b0-a92e-34ce9e8149cd", "comment": "Malware payload (Formbook)", "value": "059698d34a03a02c47d49dc6f92f084b210de287fb13c94d282956a669ef222342047b62578008da32f0b5eb32d63831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368349, "uuid": "f3d6449b-19d6-4c91-8f05-fca6434bfebf", "value": "T1E63502D43B29BB1DDE641A349975EEB442ED2D65B000BAE35DCC7B8B79AE2006D0CF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368349, "uuid": "9f199738-c97f-4f24-a4ee-059cfe4f1278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368349, "uuid": "6ce9da24-8a5f-4d96-a990-4509650be091", "value": "24576:E1BbNwjTOXS0MBduwMIxLqSR3xcWH14z3LorRX3TJYGJxX:E/NSsS0MBduwjHRyWHwohpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368349, "uuid": "ee51ef6b-1bd4-430c-a5c1-cc725762543f", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368349, "uuid": "6bce9e09-5284-42bf-9e2b-a0c6b1cc308d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368349, "uuid": "99198359-cf6e-48a6-ba82-9e4db803fbdd", "value": "e1d1541728b05edb65f174a01f5e0312a203fc4579295fc7ddf085811af4a2ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c6aedf-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347185, "uuid": "0c9ac7b3-d97f-4fc8-a445-75715496ad63", "comment": "Malware payload (Mirai)", "value": "c8cbb2162bb47dfa6ba48387520d2960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347185, "uuid": "9d697df8-fce4-46de-a11e-ff187b08e97f", "comment": "Malware payload (Mirai)", "value": "e1d415a506a4f0dcfae21620d8a7644d306b13b1879d91163b879911d0f2904b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347185, "uuid": "64c91ddb-fd5b-4727-8a58-2ea0dc9ba26c", "comment": "Malware payload (Mirai)", "value": "60cb6636a271367182358477813cb714faedb487", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347185, "uuid": "7e81e8ed-55bd-4552-b56c-40a5fd1a22f0", "comment": "Malware payload (Mirai)", "value": "507bb1ef057c38c24ce6e312f6428e91d691578654f457da5571424a59102948c9c4c1fcc75b1039640bbe718ac262e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347185, "uuid": "9d4e83bb-d908-4731-ac7d-9983e612ff87", "value": "T12F73191ABD418F16D5C1167ABE1E534E33132BB8E3DFB213DE146F246B8B52B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347185, "uuid": "10758de8-de5e-4fa2-a87a-2ee64a8a86b9", "value": "1536:mqnPEMwTfHUj80E6Fbg02kzK7Y54A5ri1x9YJQ4EFu:nEMEf0ThzK76Yx9YJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347185, "uuid": "b400d168-5c24-4599-b3b4-b1bb2cd12618", "value": 75848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347185, "uuid": "06e7dbe4-764e-421c-a049-d0bddeab36c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347185, "uuid": "717fa8d4-6ae3-42be-8f11-19fec85ec554", "value": "98oE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ad85c4-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383683, "uuid": "4f29013e-b0b6-452f-a54c-de51321fcdcb", "comment": "Malware payload (Mirai)", "value": "bf67c1cfe948bfa65094c2f8aef8892e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383683, "uuid": "4ebd9422-68f5-4a82-8f0a-9ee71cf86060", "comment": "Malware payload (Mirai)", "value": "e1f506c9def99b6f1333d312a0ba8f43d6ab44b83c8bc45da37d66ccf00fef7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383683, "uuid": "859a9dc2-0ece-4802-a1cf-de8659c24eb5", "comment": "Malware payload (Mirai)", "value": "22316ca93f8e7120e907705c4fd0f4313fdb4e0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383683, "uuid": "5d535a10-f959-44ff-9f1a-11aa706232aa", "comment": "Malware payload (Mirai)", "value": "c06e94e0444166b988311cccbf185d1954a90817f4b44f2de7d4e672f09d719327f9afa23b87e3b6d8e3e373ee025593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383683, "uuid": "17fb3bc6-f2cd-42d5-8543-706545e57415", "value": "T1FBE34B13A58084FDC49AD2748B9FD137FB32F89A1334774F2B906E712D36E616B19A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383683, "uuid": "aa97d395-5e46-4a3e-8c98-a2217ede9d1f", "value": "3072:a9PscaJqypQp/zwgQYrYZBTI68lpIERFfa+lbPnU:uyvpAbwVI6sjl/bPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383683, "uuid": "d92ee5a7-33b2-4634-855b-bf047554e696", "value": 149560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383683, "uuid": "192331c2-168b-4f55-b485-fceea241aa48", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383683, "uuid": "df4a84c8-7700-4c89-bf51-dac3940685cf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313b682a-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370578, "uuid": "fb35b481-0a59-46c3-86f4-7b428cf46ec6", "comment": "Malware payload (Formbook)", "value": "c269808c6cc5de43a33e8e95fdac1d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370578, "uuid": "010a4135-3610-4a74-bb16-ed43faca9d22", "comment": "Malware payload (Formbook)", "value": "e257db84cb1e8cd729cdcdaac986433f04e2ab600e823d880713b29b91a1a29e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370578, "uuid": "99301698-8bc9-4b58-a1c3-e9863da23a2b", "comment": "Malware payload (Formbook)", "value": "c2fa2a7001c88c6be8a2f13ae43c891dccb0b9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370578, "uuid": "801360b8-a092-4b08-a75a-18581e4e57ce", "comment": "Malware payload (Formbook)", "value": "0c27216882ff1d9de8900145fd8b22b08ec0b99bcdc804bba39de380809b5fbbdabc86e6173e4ad77e181b3e8097848d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370578, "uuid": "2b58f2c2-1d9b-417c-b01a-89f0b0afe78b", "value": "T1CE3512146B6CDD12D9E607355870E73983F3BC5DE021DA1B8EECAEEB3926B021D14B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370578, "uuid": "405886f4-a444-4b5e-96ac-65380e8a46ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370578, "uuid": "ee3a9a50-a49b-4aa6-ba3d-b7fdcb4d61df", "value": "24576:xEMg3mP4Oysxytv2dxeXY0Qap1MeS5ApUj+/uMWi3nNJkt:Sj3ITRytOdxeXY0Qap1M15OUj+/Ii3N2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370578, "uuid": "3b8b0026-12a2-4d42-af6a-947cb652ca36", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370578, "uuid": "3aa86531-856e-4568-8837-d4fa989de678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370578, "uuid": "e6e5f6ae-3f36-433c-9664-89cbfa3087a0", "value": "e257db84cb1e8cd729cdcdaac986433f04e2ab600e823d880713b29b91a1a29e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae045df-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786374003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374003, "uuid": "70331161-969e-4fc2-936a-7be4d72c37cc", "comment": "Malware payload (Vidar)", "value": "e9af0fa0b647fb2b9d3d49c7818243e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374003, "uuid": "8e772252-d7e7-491e-8f88-fff498edf486", "comment": "Malware payload (Vidar)", "value": "e270275233eb28d9d60555913bd7653c1267106a7d7e4b19bcd10c1f14afa2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374003, "uuid": "d501f33c-2b25-4a90-933d-d1868a272980", "comment": "Malware payload (Vidar)", "value": "298a87ead8d87a19567aa978a49cce188d397ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374003, "uuid": "2e38c4fe-222b-43d8-a3d9-441e4636148c", "comment": "Malware payload (Vidar)", "value": "695b4f9db0c48798ae6175c6f5dbfc8619fea2bb19d7e55cb9a3c8ebfeea92db774a6d3e65edd2656e0141bbe4de38d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374003, "uuid": "bc0b4c22-1dfb-40d3-ad37-fb7fb756277c", "value": "T1EF067C07FC9149F6C0AA933189A35252BB75B8181B3227EB2EA0B6783F737D05D35758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374003, "uuid": "50d9a001-ef4a-42e9-b207-ff53e9262e85", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374003, "uuid": "0029acdb-55e1-4db0-8150-9524fb16e4f9", "value": "49152:+YbJhn8kXzm481K5XXA4DjLva5Nf2EfSM6HJoTkgAwqc:+KTCOXBj8Nf2qSM6HsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374003, "uuid": "61fe6916-2bc5-4641-bed5-a02419a05919", "value": 3782144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374003, "uuid": "6f99725d-a200-46c7-a1b0-b286f23f8071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374003, "uuid": "e96eb85b-dc1a-41a6-a0cb-6fcd072d761a", "value": "e270275233eb28d9d60555913bd7653c1267106a7d7e4b19bcd10c1f14afa2d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2aff037-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373829, "uuid": "5639ea71-f425-47d6-9465-207f56626bc4", "comment": "Malware payload (VIPKeylogger)", "value": "8038bbdc9017ba02ba23e2060e960664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373829, "uuid": "06488f85-1f2c-44d2-ae71-39b0664317bd", "comment": "Malware payload (VIPKeylogger)", "value": "e274a75ad3ee61ef5301739f4dfee39582e4c5390937d85c9b7282629611638f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373829, "uuid": "02ab9791-64ab-497e-8a9d-01a83549ace9", "comment": "Malware payload (VIPKeylogger)", "value": "e7269c9ecbdb1861a4dabe7a0c49c80d3d559503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373829, "uuid": "1c9e2bc8-8d39-4487-b156-e04b488a10f3", "comment": "Malware payload (VIPKeylogger)", "value": "f41932779a42686007f6acf05743f42fb989400864cd752ee934396f81cb8409737b3cb61c5aa965e975e57a00e877de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373829, "uuid": "75f79773-4ea0-415b-8e9e-f5eaed34daa7", "value": "T1AD7422463794D193E073CA300EBE83658AF5FE952BA5630F2344BF49FE31640996E399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373829, "uuid": "8a8ff911-485c-4f9e-9344-0def397f340c", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373829, "uuid": "c711ff97-942c-4f69-b430-d9bee8dd6c49", "value": "6144:0XsKoGhhRqqh9QDNFZ6mXxT98wsa6QohAHxwC40c0YtjMpXM24FpdVPVnSzX86Pn:0X9hRle5b18woGp4OUMpXf4FbMXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373829, "uuid": "42af929b-0174-4301-991b-65a36e169ca2", "value": 351440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373829, "uuid": "6576dccf-11ca-4060-a09d-dee429872ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373829, "uuid": "88d1e2ac-81a5-44f7-af84-b403a212a070", "value": "e274a75ad3ee61ef5301739f4dfee39582e4c5390937d85c9b7282629611638f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0867830a-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329707, "uuid": "c2d43c12-2d1a-44e4-9e19-0004f8602a5f", "comment": "Malware payload", "value": "60f66b58ae901eaa67d6ff19a7a6c508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329707, "uuid": "a13e1c2a-c4a8-4af1-870e-7b549db09fe8", "comment": "Malware payload", "value": "e277d9df4548e1d0db551967d80c187c3e0af95224539c453e758cd4b2050a5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329707, "uuid": "b5d3142a-1512-4005-80fe-91239b0cadd5", "comment": "Malware payload", "value": "5b033c8c0f3cdf4624930cf0250a35d170a5466e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329707, "uuid": "c3e74c65-8c91-44b8-9d75-62347daf1e04", "comment": "Malware payload", "value": "037f1f8741d06021e76a638c68794234cdaddc808cb7ac4202f23f4d4b2557ea8e8aca107a9c84598c918b2a90f433e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329707, "uuid": "ec1526e9-f379-452f-8ecc-7a9ec7e9a778", "value": "T13B53836173139A6FFC6A1B7049F2CAB0B398B9D634B096E2F325BB4D0F391995D081C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329707, "uuid": "92d67867-f930-4f1a-ab06-4f630ed75a2b", "value": "1536:UFXvJm9XRDgmpXrFivvBDWmx64nmudX3vw9zPbAVTH8K0x6pg3l/4Z3HXKwy061v:UFXhmN4SzPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329707, "uuid": "b985761e-4c0d-48e9-ac7c-d56520d186dc", "value": 61088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329707, "uuid": "df2f8e9e-7de7-4404-ab3c-a1f2be0e92d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329707, "uuid": "ecb90a78-70a4-497e-880b-278f67894f95", "value": "main.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0422e3-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370861, "uuid": "8aadf8e0-f564-46a6-a45a-5380ed6d124c", "comment": "Malware payload (Formbook)", "value": "d5c017cd5a2a36ba2fe69111a160f28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370861, "uuid": "9dc51510-7d8f-4151-88a5-a128ebbe4baa", "comment": "Malware payload (Formbook)", "value": "e2dd5f76bc19e5587463d98ed6f1be4fbe824c3470af8d4a70ca208b273ec0bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370861, "uuid": "3052ffe0-7484-40d1-b5ad-b4f7badbd2e8", "comment": "Malware payload (Formbook)", "value": "45b4906286d425757ce49754fb1b4a297f54018e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370861, "uuid": "4d4370a6-52a6-4ba6-8d9c-4c85d2604722", "comment": "Malware payload (Formbook)", "value": "3a3f02338ab76b62832dae538cb69bca07604053511ed72d66f18a6a2988f5d44e909af561b4ff3a53d9a0f584d5d928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370861, "uuid": "8df4483d-c4e2-4838-bae0-5b2fa2bf6f93", "value": "T1933502543256DC46C5A31FB0CE71D3F401796D89F810E3738EE6BD9BB8BA6863D12292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370861, "uuid": "82e0e08d-6fd6-4031-8798-57391dfc7a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370861, "uuid": "1adc87a5-63af-4b34-b558-eafe757b76cc", "value": "24576:b5jR6pFsRIrwu7woTmV64BCB+5cCxZuaoyluneE5h8RYhK2tl46etW0:FtimRAwus2B+5ckZuaoylunthyYhK2jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370861, "uuid": "0316d5ff-ef6a-424f-a2a6-4c71888168f5", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370861, "uuid": "4f57b089-fb8e-4bbd-840a-624e9202566f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370861, "uuid": "e668d77f-43a3-4ef0-b285-4484a7134925", "value": "e2dd5f76bc19e5587463d98ed6f1be4fbe824c3470af8d4a70ca208b273ec0bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782714f2-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371127, "uuid": "84ddef68-f9ca-4e4b-aae0-df96672706d7", "comment": "Malware payload (Vidar)", "value": "7eada983e6eb86535c50868384a1f189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371127, "uuid": "6e5eab6e-2de8-4662-85e1-bf32c23da165", "comment": "Malware payload (Vidar)", "value": "e377b15a8c53df29920843dd445e66b0d0b709c57fd004b1cf274bd27a82db04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371127, "uuid": "6b923575-30e3-4ac7-9d52-30a9813e4a08", "comment": "Malware payload (Vidar)", "value": "47473de38a6fc56d5ca4625b45a20652fdeb3bb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371127, "uuid": "852d078d-37a7-4369-a0a4-922cd1194add", "comment": "Malware payload (Vidar)", "value": "565b6eee782b6df2ea3f13c528f075c43898726f4c5d1d9e80657897400f9ac9a9312133a9f0720319e6cde06a3702e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371127, "uuid": "daa592c3-5515-459e-858b-7ed286ba9887", "value": "T18742F986729260BCD1EDC679CBEE22B6D626305503274FFF45DCCA6537C126234B8A54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371127, "uuid": "0175c20d-2a62-436d-a852-b8328f629347", "value": "d75ba585eba136b8bb405d3a97b34027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371127, "uuid": "86de002a-7965-4795-b4a8-2f54f0264c17", "value": "192:ObdqK+MFeQ1SZh0GJdBeqLCe33lu2gjl2xp+2Z83V/S29:Ob1+A1ghF2qfu2gjlC+2Z8lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371127, "uuid": "62e9c33b-38bc-46d1-a0fd-3da67ccc2842", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371127, "uuid": "8d888777-1892-4851-bf1a-622d54cd863f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371127, "uuid": "931a6814-d743-4949-9c64-7262cd404779", "value": "e377b15a8c53df29920843dd445e66b0d0b709c57fd004b1cf274bd27a82db04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617365c7-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786369370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369370, "uuid": "12e06492-dbd0-4658-b8d3-f4147c4b4f30", "comment": "Malware payload (GuLoader)", "value": "ffda6441c86368bdb6198066df5657f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369370, "uuid": "1a645e7a-bd11-47fb-8f1f-901217b77f53", "comment": "Malware payload (GuLoader)", "value": "e3ac988ad4eac1ecce8b2eb78d7543a992bdf95468c7284d7ed2654f92b7a25b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369370, "uuid": "b4ec8299-f7f0-47f3-a448-7bff913a60f2", "comment": "Malware payload (GuLoader)", "value": "d0b43cf162f4381882f64bcb958a73f93d64620d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369370, "uuid": "fb154970-e5b4-4cca-90c1-5508dfcf8c62", "comment": "Malware payload (GuLoader)", "value": "b1db12bd11299e022cf1b268e88316379987b22a4caf7f387793608bbb28d94345c2201dc645b29746df7af46dba12ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369370, "uuid": "eed51911-b8e9-42f8-885b-00c73a7c64e3", "value": "T18894225077F4D0A1CA325931EC74DBFA46D82D79C291018B7720BF3E397A2A96D2B271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369370, "uuid": "3bfc108f-da8c-4bea-b382-a26d54eb700f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369370, "uuid": "67bb9751-2ea0-4d87-9209-cad3cf3a064b", "value": "12288:nX4nKSZ9RhsH5fAw+58oWp7IqsXlkKPGD:X4nKSZzhu5fPhFgljP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369370, "uuid": "4778f831-dc25-42ce-8c91-2e4738ae6e47", "value": 432400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369370, "uuid": "6a9eff10-6316-403d-9849-85ec3c5eff90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369370, "uuid": "d1234459-83c5-4029-9e1e-a4946e40409a", "value": "e3ac988ad4eac1ecce8b2eb78d7543a992bdf95468c7284d7ed2654f92b7a25b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a2676b-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370527, "uuid": "59e19799-4aaa-4f1a-b855-cc7fce005fa3", "comment": "Malware payload (Formbook)", "value": "92205997aa6ab592fdae1c079f1f671b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370527, "uuid": "ae67a705-320c-4691-96bf-75ab9405df24", "comment": "Malware payload (Formbook)", "value": "e3b0cd21746e06e579260f3ef8f3aee90dd4cdce6fff976f7848ecd84280a652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370527, "uuid": "74699d14-1620-48a9-af07-68dc1440e1f6", "comment": "Malware payload (Formbook)", "value": "b7c105bd03ac5b67a12fd3a00ba59bd2ec0d5e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370527, "uuid": "d4534098-d49a-4b75-b125-7beba8840f97", "comment": "Malware payload (Formbook)", "value": "89805b0fe86c6aad2c8536dd56291708c097a20b310cd0918ebdfc0910385553972e33ac96ccbb2123071fdeef493060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370527, "uuid": "19620bc9-0ace-4c83-82db-b41dbf961377", "value": "T1003512546D9DC811C4D3AB700A70E77957A8ADC8E924CF175EFCBCE77C66A066820B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370527, "uuid": "df08c2f3-7987-4f00-bb55-48ee4a90d497", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370527, "uuid": "519b0ab9-0ecc-40ad-900c-a3b4ac5cd2b1", "value": "24576:BKlCvgrfhs41tkpNvt7Vill7IL1ckMtJEhaUtF/N0RY:BKlCvgrfhs4vkpVtSC6kMtWhakRCRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370527, "uuid": "86bccbb1-c6cf-40e6-b803-a7d3cbc1a35f", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370527, "uuid": "c73f4378-ebb6-481a-bc19-5c8cd2c09934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370527, "uuid": "91866a3e-70d2-4881-9bfb-0809ba9e08b9", "value": "e3b0cd21746e06e579260f3ef8f3aee90dd4cdce6fff976f7848ecd84280a652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f43491-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369589, "uuid": "cf69bfc6-8b10-4a8f-aec4-b3467c6e8bdf", "comment": "Malware payload (Formbook)", "value": "e59139ee7ce300a7bb4094b2bda9a418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369589, "uuid": "29eee067-9f2c-4809-981f-3e431fcb8e29", "comment": "Malware payload (Formbook)", "value": "e3f2c8c6760d917ae73944d6c28ee132a471cfb5b84b3aaf071c660a3acdc8f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369589, "uuid": "767dab2f-eb50-40f1-baa7-c00f508a4927", "comment": "Malware payload (Formbook)", "value": "2af141310547423be82b4b456c39845569d1cd09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369589, "uuid": "e2fed850-9132-429b-ab9f-c387c35f8fa4", "comment": "Malware payload (Formbook)", "value": "3fa56009f72e26c2be4c461b161679264825c35231bcbb123d8ccf79188ad4ff907205dd8a8e331f9668bd6247f5bb46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369589, "uuid": "62537f49-f141-42c8-ba9f-c4939a856413", "value": "T1274501485758CE06D82A1774A8B4D2B80B785E19FA01E3135FD8FEEFB9773228C55287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369589, "uuid": "610ebb15-c776-4bf7-9dc1-4811f5258046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369589, "uuid": "e491529e-dd58-4d94-b0b5-bb2495ab1c06", "value": "24576:1AuvV0LTWVdkc1YpEIUsEIn9mqeMPliLh3FI2LC:1AuN0LsKcXsEInqMPWFIgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369589, "uuid": "6cf87ead-c3b6-4646-8ccf-41906bbfb925", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369589, "uuid": "b5a09cf4-5099-4ffc-948d-d5b1f87be2dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369589, "uuid": "2bac99a4-82f5-4d8a-a351-81da960eb06c", "value": "e3f2c8c6760d917ae73944d6c28ee132a471cfb5b84b3aaf071c660a3acdc8f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0758bf6-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786368644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368644, "uuid": "81efb897-cd4f-4695-9290-4d989c39f5b4", "comment": "Malware payload (njrat)", "value": "656c352133d8ee212d587da4c0da80c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368644, "uuid": "1ecd513e-eac5-471e-a0ac-b07a9f7ec97c", "comment": "Malware payload (njrat)", "value": "e3fbec3de73c9b3a3a20c7714e945a6ba3f20d564e7eb59626ba9a7c754938a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368644, "uuid": "d6976f25-e024-4474-804c-41550d0f2792", "comment": "Malware payload (njrat)", "value": "1c1bfdca9c748160ac4c33651ec1e3fd5b0fad93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368644, "uuid": "ae12a3d8-fe28-4a27-adf1-00a09f411496", "comment": "Malware payload (njrat)", "value": "ad58780d030edb10d56a95216b6233b362c172e146abd0016f13d2a10364989a7bcf47503ed6a4330f1cc6ee5ebe1638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368644, "uuid": "7222cb6e-b127-4f7e-8a5f-d3583863492d", "value": "T10A15E1C43B3A7705DEA8AA308435EDB552A92D78B010F5E66EDD3BC7799C2019E1CF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368644, "uuid": "576183f4-603b-400c-958d-220ca24ee92f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368644, "uuid": "b8e5a62f-8fa7-4567-bbfa-8d4023534ae3", "value": "12288:UEIBv6oiPvcnSiDxPgNhPrPH5e70fAwvdbRChz0UDBsFxe4GLuNvA15nzqZ47iqT:BfVeZuNlbw7kASdbq0UDaFwZLhEqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368644, "uuid": "02c06fb4-f9aa-4c6f-aecc-51cf59878e97", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368644, "uuid": "c36ff7df-67e8-46f1-add3-d92179fca3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368644, "uuid": "9d10f17a-a0e8-4f2b-a8da-45d45dd75b0c", "value": "e3fbec3de73c9b3a3a20c7714e945a6ba3f20d564e7eb59626ba9a7c754938a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3eca382-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372999, "uuid": "dc2cb8cb-a938-41fb-88ba-5ae0dfbac527", "comment": "Malware payload (Formbook)", "value": "c990578380966b0f6af28a445054cc24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372999, "uuid": "9785f590-91dd-4d94-af37-ec6dbe03135a", "comment": "Malware payload (Formbook)", "value": "e457fb605f56750833b4395f6dfe0bd8a200eeb15ce162bc58a31b6e066a1fd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372999, "uuid": "24a1d7b6-731f-4135-aef1-11181ac82082", "comment": "Malware payload (Formbook)", "value": "97f00887fcc0237e684ddaadd9f497d3db1b1e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372999, "uuid": "fe2b5a7b-efa1-4951-ac26-1201c0ebcef9", "comment": "Malware payload (Formbook)", "value": "9d95a73d1b09177e89a32588e0ff0a434f2093911df588646b77dbe922662709e85b92833bcd63867f02ae91dfff0942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372999, "uuid": "ee6e7825-ab91-4287-9e07-59c23b90ddfb", "value": "T13C350114231A9901E1E687F6B9A0E37032B90DCF79D2D3E15FEA6FF734197812964683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372999, "uuid": "0378603a-9a1d-4202-b20b-ff9cb71ba9d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372999, "uuid": "e72dc383-8e1b-43fd-9db4-871e19560ef6", "value": "24576:TmqfPIEg3AXTHK6XqBbgvBxYk6kZCkyodmp50:BPIEyAXTHtaBb4xRbRMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372999, "uuid": "e64c93ed-1283-4dd1-910f-ac7509e8c8c8", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372999, "uuid": "0efd3fea-0f35-48d8-8a43-16fdadc70d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372999, "uuid": "8465919e-6ec1-4e25-93f9-8859405afa4f", "value": "e457fb605f56750833b4395f6dfe0bd8a200eeb15ce162bc58a31b6e066a1fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b82f78e-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786369468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369468, "uuid": "dd1e7df8-088b-4711-8a33-a3b67053f72d", "comment": "Malware payload (njrat)", "value": "ca0ba77e4cef94ac43074f850cb0ab89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369468, "uuid": "7c24f355-1ba6-4a75-acb1-539578194c9c", "comment": "Malware payload (njrat)", "value": "e4c54fee79a5a4b653ca1ab54e4060f78f578e9e3402fc5aef68a578132f0e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369468, "uuid": "c9368541-ab52-4d0b-8444-ab5aa2a3ad07", "comment": "Malware payload (njrat)", "value": "c227a8145007c74dac3b5e7630010b4e5fdd7449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369468, "uuid": "4c7dd47c-5919-43b8-b444-de99c5fc2b18", "comment": "Malware payload (njrat)", "value": "a19a2b6c1d5603aa624dbe64a3245b6f802d530b09288e0a1ec068b162cb1df29f9b062da44153c623e9dc21c036ca13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369468, "uuid": "23a6033e-617c-4a4a-925d-3d67610f09af", "value": "T1291502ACA71DD006C4561B349D70E2B824655E89EA10D3078FFDBFEF3AB7B199815382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369468, "uuid": "dd0576b2-cac8-439a-90cf-df1d5b43ee71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369468, "uuid": "14b763f5-55ab-41ed-b44b-2ff0701b2996", "value": "12288:ThcBVwloMLGMTjVElLOUR2kEsZtT0xlmdJ/BfUaIu4ENV/91WwwHLqs:VcBkLTj25JZEfzmL/Nb4sV/6hqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369468, "uuid": "26567c43-4da5-4fa7-869c-579ab0a68623", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369468, "uuid": "f9fcff93-0940-4785-a522-9f712e3bd1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369468, "uuid": "b1092d4f-dbdf-4ab2-9cbe-6201754c181e", "value": "e4c54fee79a5a4b653ca1ab54e4060f78f578e9e3402fc5aef68a578132f0e59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eca835e-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372346, "uuid": "91c9f604-bb38-4c02-866b-88d9d80c63a5", "comment": "Malware payload (AgentTesla)", "value": "da73f74f4dc414fde296542928bbd8ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372346, "uuid": "3b1d7e3a-5e58-4608-a6f1-1cd007e58881", "comment": "Malware payload (AgentTesla)", "value": "e5e6242c6da84bd44daddd5870cc95e53ee3e7b0e0021bb9d139194376b217ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372346, "uuid": "3d1b18ba-3fab-483b-941a-4f78f7c1a481", "comment": "Malware payload (AgentTesla)", "value": "9a83f28fe9989d50a1a9878b11a7954b98b404fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372346, "uuid": "4d36973b-6360-419c-82bb-554ffab3eb92", "comment": "Malware payload (AgentTesla)", "value": "edc5d1621b352188184c9505634b442cd4581ff688f487db6ca743ebbac7564faef74f2329d39b573b88d59e2123d1f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372346, "uuid": "b61519df-2073-4717-915a-388dd43a6bd9", "value": "T101C42D3DF0A9932978710620D7E1A252023EFD8F2F5F221426EE29CED3F55905A53DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372346, "uuid": "e35f8fe1-926b-47ba-9b33-ada772279c94", "value": "6144:D5c1DiY3c7Hs/MA1y6nOBpR4/wBi2S7/d5pzpYSvmQHa61Nx1tb:UD/3wuLEUOpK/7/bMS1tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372346, "uuid": "5270c557-6878-4138-8ea7-4b809719ed3d", "value": 550368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372346, "uuid": "516e6a11-775f-4475-b7b1-daacf9dd8171", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372346, "uuid": "71979e4e-1f57-4ca0-87a2-f1042205b73e", "value": "Payment Confirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d891ffa-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383645, "uuid": "f5b2fbdf-a431-4097-bfae-925270f914aa", "comment": "Malware payload (Mirai)", "value": "1c274934a01028acd46bb7c542b14468", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383645, "uuid": "ceee54a1-e3c8-4d82-b409-fbef2723ab47", "comment": "Malware payload (Mirai)", "value": "e5f573d225d0c1afdf0b7392f658a5c6d9aec99c0d6c0d77b952572554a6c652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383645, "uuid": "5ad1483c-30ba-4d8f-9ba6-bff29a8a121b", "comment": "Malware payload (Mirai)", "value": "16b39d111418e9a62c495a5ffda07ae29de98f7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383645, "uuid": "4343bdb3-4863-4c2b-b039-dc185162707f", "comment": "Malware payload (Mirai)", "value": "e57ee7f159f928f8c7fb3643b0eb46707049a8b6e21b6e300170c5b666e58fa7ed18f095c2644243403e7f509c5d2f3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383645, "uuid": "5aa48080-d954-4246-9006-9cd97772298a", "value": "T153F38EA89A1FAD82D6C3E7BDAD694FA2303338B84754D1F70900516DD4EBED598F2432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383645, "uuid": "a0db4785-2c4b-44f2-a5e9-fa5501003ca2", "value": "3072:hIEExOVdrUwLvZyOMm/cfx+ydCF8enAH64xkY84LK+v:y9QVZLwOhkfx+ydzeJNYLKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383645, "uuid": "97b561df-598e-4c36-8dc5-436e73153377", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383645, "uuid": "3971e4a3-9b3e-4db9-a2e0-15c396be2f6f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383645, "uuid": "79a204d7-79ae-4c47-b42c-c51c8de5246e", "value": "disconnectraw.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d923a497-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371289, "uuid": "80b66d1c-5ce8-41d3-ac13-ac7984a15504", "comment": "Malware payload (AgentTesla)", "value": "e164498d1e6013a76a476eea0f5c5f49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371289, "uuid": "3b5cf543-fbd4-43ad-a11e-3eeafe58c052", "comment": "Malware payload (AgentTesla)", "value": "e641d53757ac1bd522c11841695cf1850c50eac1821d061f10e20cf5add1068a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371289, "uuid": "9bc50331-3d5e-425b-a058-01fa25cf7f23", "comment": "Malware payload (AgentTesla)", "value": "71dc2c1b8c2340b2e8995fd28a0e1b5e626855cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371289, "uuid": "1056ad67-ab1f-4be1-868b-03f1316e6739", "comment": "Malware payload (AgentTesla)", "value": "e58fb71d73d10b967bdd4ac122ce65bac92f3a01e9406c74dc16a9e1ffc2d7e39722455a20d1754b6027bb9839291c62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371289, "uuid": "55543f45-c69b-41fb-99cc-5cb47585317e", "value": "T10084E890F249EC97F81714B64D7B9521109A639890B9C31E3497B72A6AF334220EFF5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371289, "uuid": "bca879a5-978f-48ae-ab3b-11c25a6e2240", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371289, "uuid": "0adba711-4e5c-493e-a2b3-7001ea0b5eb1", "value": "6144:JR+xX+s19zBHX5CQJvScluxK3cymRJ2uQprLYZ18vpHC:nk19tpCQRSclORnGrL+1C9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371289, "uuid": "604c192e-5d39-46dd-bc4f-c13a5551039f", "value": 377312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371289, "uuid": "670ed669-a358-4072-ab8a-eb7fbb67832b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371289, "uuid": "517695fa-e4d8-4962-a074-097be3c5354b", "value": "e641d53757ac1bd522c11841695cf1850c50eac1821d061f10e20cf5add1068a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd7804d-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370598, "uuid": "b4fca41c-6949-4564-8c96-16353ff53ef1", "comment": "Malware payload (Formbook)", "value": "ca6b52cae7bcf75c283e5858b4c6827f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370598, "uuid": "204ceb3f-4901-40ca-ad1a-20a6aa6f7e31", "comment": "Malware payload (Formbook)", "value": "e65cf33ec997b5a85c5c1748d66d1e6e8f560963b16a470c685c82956022803b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370598, "uuid": "fe854846-396a-4c46-b312-12cddc4e1fbf", "comment": "Malware payload (Formbook)", "value": "291c832afec29ca6ac0d3b462c59a879d91c2a7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370598, "uuid": "42b995c8-1e87-48df-993c-2b304e8ce178", "comment": "Malware payload (Formbook)", "value": "1ec96ebe33ab2ea28fa13000198f1064adf4035c7f46497e74c77e05b9f65b74616c3b30533dd20c1c6f48eb7f714207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370598, "uuid": "c6389eb7-475c-4c02-9fe1-a824ba381f4c", "value": "T190251291A909D802D8830B74C4B2F3B596B55DE8E502D353CEF9BED3783E9593D08B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370598, "uuid": "54d4d979-7c7c-4c58-bb2c-25c4cbc5c8e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370598, "uuid": "7cc0da88-a10b-4861-9906-176e35239335", "value": "24576:QRf/LhLi/tlK075TqJVIzJhtZ+8Ump2cQYv:QRf/LhLiV407UJuNfY8ZpXQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370598, "uuid": "0f100f46-4ea3-4cf9-8b93-5f3a1276f582", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370598, "uuid": "3e1a16fe-c127-4fbc-80e5-45fa0b680772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370598, "uuid": "4bef56ba-dbe1-4691-ae29-eca678ccc9f4", "value": "e65cf33ec997b5a85c5c1748d66d1e6e8f560963b16a470c685c82956022803b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cabd5e-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1786368844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368844, "uuid": "31db3296-ea7f-4b80-93c8-7912c71258fc", "comment": "Malware payload (STRRAT)", "value": "c8592995d46b80edcb033b4bddea5054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368844, "uuid": "27fe2e41-b1a9-49c4-bb48-7c673831dd54", "comment": "Malware payload (STRRAT)", "value": "e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368844, "uuid": "d3e9ee39-0d2c-4932-9473-f65159db340d", "comment": "Malware payload (STRRAT)", "value": "1e210b0873896adf29bd656ded7c6512b6287ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368844, "uuid": "36792469-0c03-4061-ac57-1b318e6082f8", "comment": "Malware payload (STRRAT)", "value": "ceaab0b7a0026e44d909d5b154faeb2206a90d46c83b1a5a053266b69acc9aef7bfa3334c05c291d5db6d3a37b5d7539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368844, "uuid": "adf45476-9e7e-4212-acc8-327b93d22afc", "value": "T16CC42266660116ECE4198B3711D24A31BC90AC0B5FAA14DF30E38534EDEDFDA4F369D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368844, "uuid": "e7d3cc65-2f14-48f1-847d-0f8626344c31", "value": "338bf1a4d5d7f38c551931d5564ac35b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368844, "uuid": "6de83b43-db22-49c1-9f9c-93b27c3ecf2a", "value": "12288:yvhjnIxFQNJrZXTgekjyzfO1IdwXoRx4AP2x:yvJCQnZXFzfDwdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368844, "uuid": "fc10028c-47ce-463d-aee1-1f097410e5da", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368844, "uuid": "f6353cd1-baca-40c8-ba22-41a45da3d2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368844, "uuid": "084aceb4-7196-4c1b-b811-13d9bfa8d430", "value": "e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e7d203-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368893, "uuid": "c428aa95-f000-4f26-aac9-225bff33de03", "comment": "Malware payload (Formbook)", "value": "d5b23660ab1d908ea8930009e932fca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368893, "uuid": "36465bf2-1f42-4d7f-a582-446ed09f073d", "comment": "Malware payload (Formbook)", "value": "e6703bdab3769c5156ba1a08a063b502d7a544a9120aeb9965d6fd4e14683e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368893, "uuid": "e4af3ac2-b024-47e8-b779-3d01d216d38e", "comment": "Malware payload (Formbook)", "value": "c17f448fe9e1f69090894844aae1db0ecb92642a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368893, "uuid": "b2ea50e0-c6ae-4fed-aa10-2915d87e4f32", "comment": "Malware payload (Formbook)", "value": "8e202b537511d37761fa97c3e3a9128d8b8e6100dccf391babce665f1f000772edf119df2a6538fbe332c9463b821fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368893, "uuid": "55ca3722-67d9-4ab3-be48-b7a1f1201009", "value": "T1D4351208155ED803D4A64FB89A75D3F817692FDDE522C303CFCABE9BBA772A25408351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368893, "uuid": "a3a3c660-854e-497e-a85a-0a1063944da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368893, "uuid": "57c5acb7-9660-4978-92d9-febf7ec215b3", "value": "24576:Q+a6Uw2vdycQ+lRgXx/ijmT/mPKxgpZG4ETJ3scLQJKU:Za69Idy7+lRgX86T/GKxgpZrE18bKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368893, "uuid": "9de26812-c0f8-4608-957d-2466ddf46814", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368893, "uuid": "b2f8635f-4c85-4a45-8306-0d80f80749a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368893, "uuid": "ee673adb-4345-4dcd-8a46-6d76377470bf", "value": "e6703bdab3769c5156ba1a08a063b502d7a544a9120aeb9965d6fd4e14683e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d328baac-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368273, "uuid": "c3857f09-1756-48fb-8e81-86a3440f2789", "comment": "Malware payload (Vidar)", "value": "87de3b9ca8c31bf321b62cabd8823fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368273, "uuid": "7137c01c-01e2-451f-8acc-7d844fbd3643", "comment": "Malware payload (Vidar)", "value": "e68e975b759f2b6716e4653e7fabdd6ad1bf8a0d66e150de4c97ec86e35d58d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368273, "uuid": "92ffa71e-860e-4eb3-8476-0c944521f22e", "comment": "Malware payload (Vidar)", "value": "0ce09386aed06edc13a1cd072ced9b69618f7770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368273, "uuid": "426f2d64-7e14-492a-b5aa-02d785892385", "comment": "Malware payload (Vidar)", "value": "a77f51fb5835ea3cc8d75b4ccfb3e53f75d3cc3556a899183c729d5344d7df2a913e6f5e887a7e59108dcb03148971f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368273, "uuid": "3267a5cb-63a4-44b2-81ae-8917f475ea90", "value": "T17F4229C977A2EFFCC06AC2349D7B44775A253444536248FFB25894843BC2245323EF6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368273, "uuid": "9c06b9f6-70d8-401a-8773-28acba006ec3", "value": "f49ef95be1e666482f052b8d214cb3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368273, "uuid": "93806069-94e8-45ec-95e3-7e4e945f8924", "value": "192:FLaiWy35VjUCGx6kRiKf4EYCT3OkecBsMyDzrgltnQMKEuN3VOJ:FLzWenjH66k7RYCT3YeP+qthKDlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368273, "uuid": "a69f607d-9161-499e-a619-3d8a8b7add3a", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368273, "uuid": "89108658-279e-4333-b69a-af228655a6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368273, "uuid": "103d529d-b48d-4aea-992d-51af9a476fb7", "value": "e68e975b759f2b6716e4653e7fabdd6ad1bf8a0d66e150de4c97ec86e35d58d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733a1e67-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "d8d78c13-6901-4b61-b036-7cac4c034651", "comment": "Malware payload (Mirai)", "value": "131eddc5d053196e13474d253474ba88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "f8b2f85f-dff5-4d0f-8588-ffa17943ecac", "comment": "Malware payload (Mirai)", "value": "e759653346bfd8e7f818b5ea8e30e372bf2143f475af9ed50950c97c87392f37", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "32a4f06e-b9e2-4e32-b31c-88597d461cbb", "comment": "Malware payload (Mirai)", "value": "7a9b056a0b9341ce0692637423f93c495951b31d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "511bcd32-eafc-4cca-86ae-6d573a44aca7", "comment": "Malware payload (Mirai)", "value": "50a7458f2ce82f5996c2c9a6bb73b739a809433f3f370cd42f42d1f89c9689f57a2e039a5090d1498fe89f98abc9168a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "43889828-428a-4839-88c3-d1409ccaa618", "value": "T14214C097B74B19D0CC0602F807CF6FAE6A2312430DBBC6EBA9697B35543A4CE52157A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "e5ef3b2b-9cff-4963-a30d-8c3e2b381f83", "value": "3072:WTEek043s4A1rP59/gxf32QxNwEgyRdP89qrYWgrCuC/i68Oe5STrq:WE1k7k3lwEXTLc7CuC/iBETrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356945, "uuid": "0a3e2a08-6783-45e6-8141-cc7dd3ec46f9", "value": 207748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356945, "uuid": "34992d1a-9456-4f84-af3f-0bb5e05fbffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "181bd065-8128-434d-825a-f319f2bcb25f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb78fec0-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373468, "uuid": "26825650-775b-42b2-b0e0-40b57c8a0a5a", "comment": "Malware payload (Formbook)", "value": "807acfbc0ef8803b4304c66885f3aa41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373468, "uuid": "79314a2b-5dcb-4f89-8b06-c0a13720697e", "comment": "Malware payload (Formbook)", "value": "e768cc4262f2d9c12b81a822ab4319c9db377848960fd798230f0ded13159615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373468, "uuid": "03ce5d20-d29d-4a9d-b96d-578575296728", "comment": "Malware payload (Formbook)", "value": "073225b1d235d32b4cd5ba91e9e19dd077d8068b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373468, "uuid": "913cdf50-adff-48ab-bd6e-208d29eeb1e9", "comment": "Malware payload (Formbook)", "value": "06b3e53d20589058437834fdd0306ef403f795fac0ce1334008f3780b9b396dc57da19fce2046bf30187e5a6675eb827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373468, "uuid": "e1c2093f-7ac7-42e7-ab76-8c97af616d78", "value": "T10D35F18522C599C6E0C287B2ACB0F23832791EDB75E1CF929FD9AFA73419381157419F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373468, "uuid": "f969ba68-2c79-44fb-abda-a99e571d7160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373468, "uuid": "795aaa3f-9578-4951-9857-f3701f324b6a", "value": "24576:XZvYp501weIjUy8yONUzclf/ZWw4tcc467iwp4CZTxlR:X+ppjqyEnlfBpo14KHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373468, "uuid": "dc9ca0ff-76a2-4e2f-a34b-07961c2426e2", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373468, "uuid": "1e3e58c6-e0de-426c-a836-9d5d2466aa45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373468, "uuid": "741bb1bd-9df3-4758-8de5-953ea9ed6c96", "value": "e768cc4262f2d9c12b81a822ab4319c9db377848960fd798230f0ded13159615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b4f895-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330183, "uuid": "fa10b6f9-c5f1-4dba-832f-5636832e083e", "comment": "Malware payload", "value": "6c4248200cb5248fd723047c269cb9f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330183, "uuid": "45abceb0-7165-44e9-bfde-d0e1eb5d1636", "comment": "Malware payload", "value": "e781903355b63bf4ee93fab422edabff146ed9c2523a2fdbb4587c6999ad9a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330183, "uuid": "68d07341-4c55-4edb-9759-4c266a03dc46", "comment": "Malware payload", "value": "8bc86785d40e47ce38249592c5832e4ee6bf4535", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330183, "uuid": "1717c0fd-02a7-4390-8d9d-bfeaf9fe544c", "comment": "Malware payload", "value": "cef034a8f1ff64612fa67536e08eabf19eba9aee1512db24f876f61b08bb4b8f9b0cac67f4e46571264b8dd5e22ecf8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330183, "uuid": "b82704fe-c97d-4806-9c2c-1d0b7af7f195", "value": "T1E6932A4B660779C0F17101F4A3CE4BD13F2260DB6B3A5DB6AC7902F6ABB319A1C1DA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330183, "uuid": "8df8f8de-d3f9-461d-8efd-08456b577105", "value": "1536:rQkclDpkPewIexIDHrlymVY5ovVavIyRGJ/gfUn5p5M/LWo:rQkclDuPHKrrlHu5odMI/gfhqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330183, "uuid": "09ee3b35-2154-418f-a8b3-0ce27e1b4fea", "value": 91616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330183, "uuid": "7bf12919-b794-4b0d-bccb-84289a4496e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330183, "uuid": "4499d30c-112f-48c2-872a-fb11080a62c4", "value": "main.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fe7b92-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372091, "uuid": "66257c1e-1490-4935-a6e9-32557512f5c5", "comment": "Malware payload (Formbook)", "value": "8052ef5d313e64bbc285617006484be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372091, "uuid": "71eed23d-0e5e-48f6-bafd-ef08c6a5e71f", "comment": "Malware payload (Formbook)", "value": "e7c895444d0c5e5c9f2b320efc8636e7a818b748b2eb36ae1d7bab671af0fef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372091, "uuid": "1936b27a-298f-47de-8e74-a54f6b767210", "comment": "Malware payload (Formbook)", "value": "18c3b6dc65497d704cf3717c4de890f4b405e0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372091, "uuid": "5d4cb6fc-8e06-49b1-b3a5-802084fd2ffc", "comment": "Malware payload (Formbook)", "value": "43149f8984d51d73284db32738050fe7f01f142c84f2c2acec5ce58a0fd38007a687094eb145ee15a5145032eb3e38d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372091, "uuid": "c6e9c689-f67a-4b92-8d89-cfcc3c756858", "value": "T1112512A99386DA17C6835B74CDB3E2F447757DDDD900DB174AE8BCEBB0397620820262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372091, "uuid": "1620fc54-789a-4225-9261-12efec11f373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372091, "uuid": "3a485eb0-0e17-4dcb-b266-b5d1f1ba7fff", "value": "24576:Sj/Og3x/sxSVEBpRHuh5+UtQxWJ4MM0Va6:gPhAB/DFWOMMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372091, "uuid": "697d7a54-91a1-413a-9200-e883057f4520", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372091, "uuid": "72a3287b-9361-4986-9fa6-03cc4f59309f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372091, "uuid": "28e411a8-36a4-4a4f-86f1-014590c5612f", "value": "e7c895444d0c5e5c9f2b320efc8636e7a818b748b2eb36ae1d7bab671af0fef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad32ade-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786372903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372903, "uuid": "550b584a-dded-4801-9a49-be03f90ca90a", "comment": "Malware payload (AsyncRAT)", "value": "2fe0e6a75bb845a357aa354e6b9047eb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372903, "uuid": "92250cf9-66cb-4eae-a8ac-520e4bbe9d43", "comment": "Malware payload (AsyncRAT)", "value": "e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372903, "uuid": "3cce654e-7228-464f-ad10-fc007d937fef", "comment": "Malware payload (AsyncRAT)", "value": "771cd64c9e1d2d32187bebe22eaf360590cd39aa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372903, "uuid": "15643b96-3989-4721-9c71-a254b649fe31", "comment": "Malware payload (AsyncRAT)", "value": "751fd664dc454a6955b3c30b240d4a4950e1e2e6bd847fe41f49795a2a727d90d1f1ad0529f6bbb557ce2c5aa05ae76e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372903, "uuid": "125947e8-18d9-4a28-a3a6-a810d88103d2", "value": "T1D9A5BE19E3D815B8D167DA38CB61A332C6B178524771E58F0A99D70A2F77E908F3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372903, "uuid": "d1ceb36b-afd8-4486-8545-aed31a6ffa5f", "value": "46d844d880996af2766416e3e2079244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372903, "uuid": "5527ce5d-4aca-436c-b06d-d62f5bd3db5a", "value": "49152:nlGSiCDMHirjJw/gG1ePK6nFhcCXt1INiHNm3pLZi86gzz:nlHS6PXt1INiHNm3pLZi86gzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372903, "uuid": "e570a7bd-792a-416d-ba95-98bc0f717688", "value": 2171904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372903, "uuid": "66721d63-31f2-4a6b-a4eb-865cc7ccbd75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372903, "uuid": "7b108ea3-356f-4d4f-9336-f73eb60508dc", "value": "e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67399a96-947e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340604, "uuid": "7ab4cd66-8223-4a03-ba09-42b3a66798c2", "comment": "Malware payload (Mirai)", "value": "33bff93709a655992576e25561879adb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340604, "uuid": "c4ba63ab-2f9d-4457-953b-77829b242205", "comment": "Malware payload (Mirai)", "value": "e80c4b8f0b5a97736927ccf101d70da5db8f5433892a68845c78587893378198", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340604, "uuid": "f68083e1-af77-41c4-bb8e-18c4f1e89d19", "comment": "Malware payload (Mirai)", "value": "0411b8f0e1f7c4e7d373faebbeade503840bb01e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340604, "uuid": "af1f20c2-b66a-425a-8b7a-19c4b7f43f9e", "comment": "Malware payload (Mirai)", "value": "a900ca7c2a9f2efd04f573d04e396ecb686a848ad70bce2c37e91ed4ede7a2179a0977d48c6bd125198373041f0adfb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340604, "uuid": "d9ae9392-7145-4954-8902-bcd3fbd227f1", "value": "T140A53953BCA408EAC0AE92358966A292BBB1BC454F3123D72F50B77C2F76BD05D79740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340604, "uuid": "331a433e-3179-4977-a0e6-e4cce7051c34", "value": "49152:sYQbQMbWZ5B6kWdz75zFfDTKrBe9ygKbP:9Ea6xAES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340604, "uuid": "c51f27a4-9629-47f4-b484-76da0db33bc8", "value": 2232612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340604, "uuid": "d39aab8f-d2df-4ab1-a709-c385d04520c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340604, "uuid": "b1e58a29-e552-4276-8749-7a36dc297fb7", "value": "adbload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46cf890-945e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786326990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326990, "uuid": "65043c31-f276-4de6-a567-3f23c69dfae6", "comment": "Malware payload", "value": "a639e66dabc9503ff477d27ba6492e06", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326990, "uuid": "34b3b2c3-ed81-4ee5-94f7-abc808fc9cbe", "comment": "Malware payload", "value": "e81d62a221ae112e6184c3eb152082ab5ceefd9ba3ce15aa38968dcefdb47a81", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326990, "uuid": "f41a7ddb-8930-46a7-a3a5-4d3b559d5ab3", "comment": "Malware payload", "value": "3381cd94d24c3e318bcf16a4f88740c18e7a1ee6", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326990, "uuid": "ce753367-1b9d-46f7-9959-027aa7e111b9", "comment": "Malware payload", "value": "b67b12dd46ab4a74b5c59fa5bff9d7472414a097e88b23c92a18028c3e290d049fc1c8c6632da7298dd8c2716ef6be18", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326990, "uuid": "4c9a3734-7a2e-47d4-811a-5b77c05ecd90", "value": "T1EE28335726A880E8E266D034C4578AE7D7F1BC910B79C79F10A07A2F1F776A20D6B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326990, "uuid": "fbd41308-59c7-4fa3-889d-d47eed5f8a12", "value": "50da9c66b00fd68bbfb8d54a47418acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326990, "uuid": "9da86011-0f84-4688-9b89-57c15ac716fe", "value": "1572864:BlcFQzO0I4nP/baeAq5/0T1QsB5WJKeAYA//8pHYP0XKECgVt7BZb+NXa3daJ5:0FnEnPjcB/YC/8hYP0XxZJB3ta7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786326990, "uuid": "f9c5189f-b68e-4df6-942d-23b35080a27f", "value": 95427462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786326990, "uuid": "a7a59a69-7bcf-4601-b99c-d2e5e34f8a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326990, "uuid": "4f8b49f2-daec-4646-8a2e-4a9eb1821e1f", "value": "uuyc.4.1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6750f7f0-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368521, "uuid": "4523593a-6a83-4751-9bc0-b43fa412d2f3", "comment": "Malware payload (Vidar)", "value": "3f00b1b7aa1354bbd16ee340dcc25abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368521, "uuid": "634b9659-3cac-4426-bfa5-6b44f8d5dfb7", "comment": "Malware payload (Vidar)", "value": "e854df4498dd203b4788a1179a5af82e3463845dbd8136ea3eac58b525595efc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368521, "uuid": "237bb134-7826-4efc-b5ae-fce119923861", "comment": "Malware payload (Vidar)", "value": "fdd5472788ceb3f529b49d20eba72aac0b34c4a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368521, "uuid": "a07e2b90-4d30-4a8f-9d5d-86f53719cb85", "comment": "Malware payload (Vidar)", "value": "b00befe77af0f542cfa5ee0eb9174913cf004b0f953d4f733ec90f0c94e17aac45a0b5623f538be648fb9b0c3605964c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368521, "uuid": "c2b942ff-85c2-4b8b-9cee-985f2f3d1ad7", "value": "T135825155E22752B4C0EBC737A75A426751F87C0122329B7BAFEC87711D52334B6282EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368521, "uuid": "83ef13d2-4cf1-4bd3-b4ec-8aa26a7afcdc", "value": "4b0c36d710a9f321af707a3125adb015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368521, "uuid": "d1125339-56a4-43a4-9132-87b9e640499c", "value": "384:StcO9lBSXxPmFlbVUVmqlgbOIfkSo1uulwdu:StcYSXpSisagbOIcSoU4wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368521, "uuid": "6dd3374a-946d-4ce5-ba87-6ee1689a79bf", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368521, "uuid": "018e2724-6372-48f7-ae1b-df47b3d2fdf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368521, "uuid": "4ec1e8b5-f38d-46b1-a5cf-815a107439b8", "value": "e854df4498dd203b4788a1179a5af82e3463845dbd8136ea3eac58b525595efc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd060b9-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373931, "uuid": "f08f6763-89f9-4d7d-9bcd-7c250474959f", "comment": "Malware payload (Formbook)", "value": "a012e64e03c77ec1b8946ac9070ef97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373931, "uuid": "567859f5-c23d-4402-874f-eb8c3c916708", "comment": "Malware payload (Formbook)", "value": "e8783275d1135e522355850d43355952456b51b4bd671c4e148bf03fef7ccfe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373931, "uuid": "367f4a5e-6052-4f85-9ad7-f2e67f59f016", "comment": "Malware payload (Formbook)", "value": "f072c3753f59e58f217186d6d3c1c8c33f7e68cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373931, "uuid": "c44bbc48-c011-4851-a823-0282484b31af", "comment": "Malware payload (Formbook)", "value": "65fefe85ea67e147060babd34c540eca6282ffd31cff6e9160a80a9f053a99fcae23305c81b32bb7cecb9d0f26d3c8f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373931, "uuid": "78de88a8-a365-4ecc-885d-4364bd45f262", "value": "T1B92522882BE64722D87B0BF5047BD53117B56D9E5630DA4A1FC9ACEB7E03B204938367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373931, "uuid": "a844db97-38a4-4ffe-8a2a-87ba33f76adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373931, "uuid": "2ac83587-2d26-41e2-bbc7-e06ef5473548", "value": "24576:G9uv0UyV8ZUVMbQd0J+iTBxwUUheAbd8yx1e:mISi+iD+kEhhd8c1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373931, "uuid": "ee329d77-f91d-4f1e-a84c-6ab88d9a6cc3", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373931, "uuid": "a0aaf317-c913-48f1-b6e3-5b225185649b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373931, "uuid": "172bea15-6ab0-4c2c-a925-5ee06029664f", "value": "e8783275d1135e522355850d43355952456b51b4bd671c4e148bf03fef7ccfe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a229d1-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368869, "uuid": "67fd6b13-5196-4257-aab0-665cbe4bbe8e", "comment": "Malware payload (Vidar)", "value": "1a01c0b4ad0dbe37eb0795de8c062888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368869, "uuid": "171579aa-5600-4c2a-98d3-dfb4050d2155", "comment": "Malware payload (Vidar)", "value": "e9712c3cdfc7030f63e7582b3256e0c72eab15e3ed40d350c39498d3f4920286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368869, "uuid": "4a54a4d1-f609-4586-83ff-aef2c2f2fa98", "comment": "Malware payload (Vidar)", "value": "e1eab930626e4a599d068cf203ffc0263ce50a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368869, "uuid": "1d2e273d-e24d-4c06-aac0-1a2c7641530d", "comment": "Malware payload (Vidar)", "value": "4ded8698b59d2d918dfc03a7c6fde4b62d573df0e5a0cba1ce440f6162725ef86bbedb90c745400bbe0af0960e32ec3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368869, "uuid": "1b25ec83-5eed-4d69-ba73-559eae9c3366", "value": "T158521A5A71C730FAD528837DCEEB66B7C6237099031B6FFF46EC8A9455D012129B8622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368869, "uuid": "2d8a4a8c-57b5-4335-bc76-4b847d954eb7", "value": "91b9540106db90aa9e5ff8e423e1b67b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368869, "uuid": "f780e143-65fb-40c7-9b46-ea98ea857dd0", "value": "384:ONhKFAj2q9m6vz/KvDuV56rC2xV7BAlh:2KFt6GvKqrCeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368869, "uuid": "af7a38d7-2540-421b-9d80-44f3b0be1eb0", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368869, "uuid": "4a581e25-eaa4-47f5-9f3a-681125a0b564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368869, "uuid": "67c021fa-7dc1-487c-9313-fe2c8195990b", "value": "e9712c3cdfc7030f63e7582b3256e0c72eab15e3ed40d350c39498d3f4920286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce849cf-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786345955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345955, "uuid": "5e05cc48-645a-4dda-9283-b544cc47c95e", "comment": "Malware payload (AgentTesla)", "value": "4cd3ddbea60eafc244b4fbfdbab25c91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345955, "uuid": "412cce4f-9e85-4e60-96a6-86e6e8614aaa", "comment": "Malware payload (AgentTesla)", "value": "e9855bdf3f45a2ed0148a1f6714f6ce081f4da526aeb044d2e58ee394e62078b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345955, "uuid": "aec66e8c-3368-4023-9733-01cd414d77fa", "comment": "Malware payload (AgentTesla)", "value": "883d68eb68b0f62c8edb80e0984ea930676192bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345955, "uuid": "b6d400e4-1383-4689-90ab-1619657046ed", "comment": "Malware payload (AgentTesla)", "value": "1b0b05e7c9762cb557ca6c9dd82c7b18b3cd29b07c852d419d4dab7ea214c55e6d7efb7f479bc70e77e8f28e3c35684e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345955, "uuid": "6edbdeea-3bc8-4572-a87e-fee5e2a26c2a", "value": "T1EE134963DD350A55490B239EFC499A60C6B8850ACF2710E1FEE9E70D980AB9CE3FD51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345955, "uuid": "0f8a0798-f398-4ed4-ab99-dc1effef16e2", "value": "768:LYGG6u+OqyRPDWhVVS2WLQIOZX8udKQ9RlWAVs+XLgVUkW5iYVMxpsti6hg4obYI:LYGGt1WTV/KOplTlFscbVMxOi6hsYMJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345955, "uuid": "87ddb3f4-e34a-45c8-9b54-5405ab21cf64", "value": 43315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345955, "uuid": "e51265e5-9107-446f-a28d-5e4e81e482b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345955, "uuid": "4b44b108-ac57-4a05-8e23-80041ab2001e", "value": "PS-PO0726-8406.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b46ac1-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374132, "uuid": "8bc1fcf1-e5d9-404b-bbcb-906bce45fd0e", "comment": "Malware payload (AsyncRAT)", "value": "2e9929ed02784c7c0110d82cdc8841af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374132, "uuid": "aba65174-e7bf-47d2-84be-bbd21987567a", "comment": "Malware payload (AsyncRAT)", "value": "e99693343427baa9bdfc79f00d11555bea28f50ca8e7247f9a54c2edd7d05e10", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374132, "uuid": "12520550-eb7d-442d-a697-23ee5b3ca11d", "comment": "Malware payload (AsyncRAT)", "value": "1ae2d18ca25d196245ac19b53803ad9dfa73856e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374132, "uuid": "6cdaf6f1-ffc8-41f8-845d-af7868d39702", "comment": "Malware payload (AsyncRAT)", "value": "ed68454e3405f994de7d9453167fef1e4ed2589b60af4bd085dfe8a5e74b81882bcf9e8d11d5928283b7b7d7d0d93c44", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374132, "uuid": "aa5ea75f-b7cc-4696-93fe-a4986f7b2f35", "value": "T13005F1983A0ADA13D9A547B84E72F6B9177C2DDAE501D30B5FE86DEB7939F008D04243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374132, "uuid": "ba3a4766-acc8-4620-8c35-02cd2cd7df45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374132, "uuid": "a068a84a-c9a5-4225-9668-f14fd26f9d98", "value": "12288:zqrTxf/6zEL691ieR2d/9B6HZDmVPI9SLiovTsmQgfWluK1bwxfNhbztW7rV9tSA:PieA9sI5IwWo7smQiuh18xf5ArVbSCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374132, "uuid": "edf1beb8-aaf4-4b32-8682-d135b444377b", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374132, "uuid": "ffa37a7a-a06a-4c8b-98a9-ceaef4b3e7da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374132, "uuid": "787112c8-4d64-4573-8b3f-cbc52aba8747", "value": "e99693343427baa9bdfc79f00d11555bea28f50ca8e7247f9a54c2edd7d05e10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d4723d-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1786370552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370552, "uuid": "fd61357c-84ca-46ae-8bbc-8d09f7099a24", "comment": "Malware payload (ArkeiStealer)", "value": "5336ae04b8d23db79636f7b70fa0c1db", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370552, "uuid": "67acb53c-2b49-43dd-b825-a667ea32a51f", "comment": "Malware payload (ArkeiStealer)", "value": "e9b55887fe9c3e632528f1cb38421bebcbfaa37086c758ce5cf227b03296463d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370552, "uuid": "f995625c-951c-4ebf-b30c-3e54e62901ba", "comment": "Malware payload (ArkeiStealer)", "value": "ff7a90b1c987111445fc0b4c81c8753cca30abfe", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370552, "uuid": "cb8d49e4-bb71-453c-9f7c-07eff1832779", "comment": "Malware payload (ArkeiStealer)", "value": "44237dfab354d82c9d6fc0c25d3d17b84bb50c952180984163cb5da7a47ba897610f3fd92f98e5941b951e25b7310176", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370552, "uuid": "585f0e36-9b42-44ad-9165-74fd939cfcde", "value": "T1EB569D0BBDD409E5D49A927698B242867B70FC4A0F3263D72E80B3783F756E09D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370552, "uuid": "297ab3ae-152e-45d0-af05-22102c85c321", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370552, "uuid": "a61707a9-07be-48e5-8a0c-8aff7d096f0b", "value": "49152:cTudpTwXugfEatDMlOV1/NcPrrplc+aab9BCZNUg883hs9qvkpANbF:ciEOZli/IfI8BqzZkpA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370552, "uuid": "aaf485f4-f64b-4a04-8745-2e2704c41f46", "value": 6235648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370552, "uuid": "618328ee-b589-45f6-8067-df4fff67ad34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370552, "uuid": "8ff8a72c-b636-49fe-a483-edc3726d65c4", "value": "e9b55887fe9c3e632528f1cb38421bebcbfaa37086c758ce5cf227b03296463d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edffcc97-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371754, "uuid": "ce8cb097-2cf2-488e-8ed3-62a52a1c10df", "comment": "Malware payload", "value": "60ad63feff1ce5f8673db456e553aae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371754, "uuid": "b385ec4d-2061-4cfb-ace4-a4a14572eae7", "comment": "Malware payload", "value": "ea006d3ec9701a39556cf70d91fe20c6f04f2b6790eda348d6235cfcf87ff290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371754, "uuid": "393db295-edab-427e-8fdf-725b2d6c0737", "comment": "Malware payload", "value": "38ace64e9400e51a9888d94be714a13cad58d40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371754, "uuid": "ed1526ce-ddee-4398-8d24-d536939b7b9e", "comment": "Malware payload", "value": "9c92832fb1c22f6adc2b4683e28a831dc9bb3023d64b6b663a9848e70616fd1bd3299fda5f2e05f177e764ad2da8e3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371754, "uuid": "2a2bc2c0-dba8-4b0a-a68d-610691062c47", "value": "T124851225694B6A69DF3E1B78C025188433F0C6169317CB2F3EFDA2F88A57794AD27113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371754, "uuid": "27d3566c-fd79-4a98-b351-48760a20db0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371754, "uuid": "6822c60e-d9c3-4e38-9f5f-21af95dd369d", "value": "49152:VqPRcvEE6UzaM36jCJUwBlERWIwCk8Rh:VqP+Lj1JUQZDCk8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371754, "uuid": "46ad86e3-d660-40ff-94cd-abbead1393fe", "value": 1863168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371754, "uuid": "0b0bfc81-11a9-4245-b68f-3e08b0b78971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371754, "uuid": "48b0ddaa-63aa-45b2-aa15-ae89bde70581", "value": "ea006d3ec9701a39556cf70d91fe20c6f04f2b6790eda348d6235cfcf87ff290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf78630-94bd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786367643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367643, "uuid": "eec29738-5e33-49bd-8bb7-34f96793310e", "comment": "Malware payload (Stealc)", "value": "783d29427510422ae80ef86e9750cbda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367643, "uuid": "36d69610-99ae-41da-b379-1222a12a1e46", "comment": "Malware payload (Stealc)", "value": "ea08dc0f61ebaa53fdce75bc84cff0c6cb87cb3a83f6c54efd57ed286eccbb37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367643, "uuid": "94979d2b-457d-425e-bf84-369d57dc89c9", "comment": "Malware payload (Stealc)", "value": "3a33c5050351eaf034a4127ab7be087a2f4bcfdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367643, "uuid": "c489b076-f3e6-4fb9-8c32-301e27bd19a4", "comment": "Malware payload (Stealc)", "value": "fecc712aef1fdddea7ab24fcbe27b1fe1ba29214923614aa98250efa1743dcdc67940644881b2dd7619f80eefd354074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367643, "uuid": "f6fcf552-6411-4f9d-ae5d-57e1f69b5b0a", "value": "T1D6E57C07AC9648FAC09EA33188B746867B75BC091B3227D32E50BB382FB67D05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367643, "uuid": "9da9708c-caad-417c-9b40-ddef161713e4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367643, "uuid": "652d01be-5b58-4569-9fe8-08bbe53e9672", "value": "49152:hJqqX100jFFXTr7eUamx9f6aFoU6Ysfmta1J3Z2:h31DrKAdWXmQ1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786367643, "uuid": "ea2563b9-0c49-4f85-857f-71aad9249b18", "value": 3255296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786367643, "uuid": "d17a83f2-4917-44e9-b479-aa1c2b5280ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367643, "uuid": "32e3b89e-f9f5-4dbc-b4a4-41b2fe7c563f", "value": "ea08dc0f61ebaa53fdce75bc84cff0c6cb87cb3a83f6c54efd57ed286eccbb37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536942c0-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372353, "uuid": "29d867f1-8fc8-492f-91d4-7c72f35a8db6", "comment": "Malware payload (Formbook)", "value": "cc8a4d7275187dc729bf2ecfff710f60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372353, "uuid": "0f68eaad-7032-45de-9e3c-efba94f69a39", "comment": "Malware payload (Formbook)", "value": "eaaeb088a57b2e47240bdc34c076340e7bf6e33ab515a2d5afda542ec6d00c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372353, "uuid": "991a2720-8dc5-4a07-9bc3-d0d176d12cea", "comment": "Malware payload (Formbook)", "value": "a995118a42461146b2bd06a022177a625e2dd92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372353, "uuid": "d3987645-9455-489b-b9c4-083b2e85d49e", "comment": "Malware payload (Formbook)", "value": "93f87a8d77df3d250986fcbd82ddec2cf64af576088e6e1a8c1d9882548b7d3f941cf74064a7ef966b91a60583198c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372353, "uuid": "9b1e8fdc-de0c-4168-9428-479300a28dac", "value": "T1432512C4B2EAEF19D57947B089B1E0B103B46D0DE431E20B8EC9BDDBB5B4B265809753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372353, "uuid": "2ffc735b-7ec0-4f28-aaed-c587722f9b42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372353, "uuid": "f284f538-ab66-45df-8454-bc3325da897f", "value": "24576:MGj/Og3Kua2f5QT6/y0Sief3C3bphC6r5irpnDJWEi9Mxs:xP6ua2BQuOiu34Beg9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372353, "uuid": "85d58db5-4ded-4588-b3b2-8bb58d586697", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372353, "uuid": "4d3dacd2-4a52-4d6b-b325-8cc5a3ba78c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372353, "uuid": "ccc122cb-a949-469c-9eb8-fd0b29dd4b1a", "value": "eaaeb088a57b2e47240bdc34c076340e7bf6e33ab515a2d5afda542ec6d00c0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af877f9-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786374165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374165, "uuid": "780554f0-1a69-4a41-9345-72ba3f036a95", "comment": "Malware payload (Formbook)", "value": "f6035a1719422a83eb97e51de1f9fb5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374165, "uuid": "c0398d34-3683-4f3f-9044-32d82fa2870c", "comment": "Malware payload (Formbook)", "value": "eb1b424a41a5d8e02ad74d0446738038ff3251f4e58f0605546dd00cbbd1d158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374165, "uuid": "3c18353b-c87a-449c-b22b-2f530a5331e3", "comment": "Malware payload (Formbook)", "value": "27852ed3fa26f88c575278166be470ad06da05a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374165, "uuid": "9b62daf4-96d0-4443-a66d-a22c94b59e59", "comment": "Malware payload (Formbook)", "value": "29858878d39e28e3503f630c887fb45f6d3119e133422f4ae686a7c4f5c4a5f0812a7aad6920bb6dde3dca578d6dbc73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374165, "uuid": "03a4d6cd-39a7-49f8-9e30-6bd32a3df794", "value": "T1683512886A1AEA06C4A453B94FB1F2B813781DD9F011E31A9FDDEEEB7575F058C04293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374165, "uuid": "324191a8-05c3-4c92-bb86-17188263505c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374165, "uuid": "9b331bf0-5b65-4298-b8e2-d2902c484338", "value": "24576:sYPacPa6ErVmKR6k4UswFcepcpMS2ZriRMAUeA9s:sYP/aFrVmANpe6axOriRxUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374165, "uuid": "d4cd3a03-080e-4f68-89da-7ac63ca3ddb6", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374165, "uuid": "fad7545c-29ee-427e-a12e-79d60176a020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374165, "uuid": "0887bee4-c6b6-4037-b6f0-f336f14ead6a", "value": "eb1b424a41a5d8e02ad74d0446738038ff3251f4e58f0605546dd00cbbd1d158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ddf828-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371015, "uuid": "c51e7d5c-e7ab-40c3-9886-6fd2b7a2bf9f", "comment": "Malware payload (RemcosRAT)", "value": "7c2b84dff33a91d5192fa1b473ab2d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371015, "uuid": "6533599c-c1de-4514-80cd-f56514751fd1", "comment": "Malware payload (RemcosRAT)", "value": "eb2cd2c52a03b20d87ea129eb09842e8ece28bf7476a61d3fefc229b0e8622ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371015, "uuid": "a5ce42a1-86eb-495e-abc0-e1f21b94eb75", "comment": "Malware payload (RemcosRAT)", "value": "779de34d096b1c28159ddbbd3e40297b4ad238e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371015, "uuid": "7dcc2b67-57ec-4a44-8425-89a4d27e8fb3", "comment": "Malware payload (RemcosRAT)", "value": "683722da7095089e288900186014a977215c5171592e180b7f1c26d3d825248a54d7f71356767a1a3942e2bf8a2ceafc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371015, "uuid": "ad04dd7f-f3b8-4d6c-a435-6a811ebf1288", "value": "T100150244331FCD02C9A3AFF01E70F3B805695E95A825E7538EFEBDD7B86A2D52885181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371015, "uuid": "29023ec8-a802-4ec8-8316-e56b0a827a57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371015, "uuid": "54ddad5d-08e8-40f5-921f-82aa9c8c79e9", "value": "12288:IN64pzhU8dE8W9IXwAk3XPClLkuScs7lJRvMFnH3zP1Db1nQxCwjdAo0/fJ6L9Ft:eHgrXalFihiJb1ns/xoR6pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371015, "uuid": "f889a0a7-2da2-4135-b31f-e39db09c8ab9", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371015, "uuid": "c82de85f-56a1-4371-b062-25d2f5ae85ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371015, "uuid": "d3be284d-d678-4074-9c3d-872b23bd225a", "value": "eb2cd2c52a03b20d87ea129eb09842e8ece28bf7476a61d3fefc229b0e8622ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f47bcf8-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371434, "uuid": "01ff541a-ba03-4070-a4ee-5f9733aa5490", "comment": "Malware payload (AsyncRAT)", "value": "1722928c0da0c022d2f9ebd22227db19", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371434, "uuid": "16ba7d2e-73f8-4037-a082-4430c2dc7363", "comment": "Malware payload (AsyncRAT)", "value": "eb3fb2f071fbb6e9860c1edf846eb9edb1834928f1193e412941e14a5c7de8fe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371434, "uuid": "054e4e1b-34ff-4dbb-b722-0ddfba724e58", "comment": "Malware payload (AsyncRAT)", "value": "09bbc6f62e670fd9ae6b451dbea287e878ca9ba7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371434, "uuid": "a7df4934-a46e-4d14-be03-2b42ef512b84", "comment": "Malware payload (AsyncRAT)", "value": "ececaf387d38e1a44ad61cc7d04b2f3966f1782a4b0ac5b551b5741de9d11071c4f1d1ec3709f367ac78af509306a3e3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371434, "uuid": "2012ca5c-9b52-48f3-8d2f-21742f882680", "value": "T1B774F1292F7DD65ADD710F389CF6F72085A88E955C658F8BB7043929BE30ED09C09326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371434, "uuid": "c854f129-45d7-4895-a3c1-fad4146e4439", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371434, "uuid": "7c962c8a-f4b3-476f-ba9e-47ea9fd57218", "value": "6144:ST4DtYa/h305o9fgqMUuBQWYmETqusTe56EKINPGfpAHRm/PWeqreuepQGuzHH:ST+Vso4DUoQFmETbsTenrPGfueuHG2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371434, "uuid": "75dc87a8-636a-4654-987e-baa8dd455c0b", "value": 361488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371434, "uuid": "ff872c05-88af-4f7e-bf05-3fc2b277c26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371434, "uuid": "187ec951-eea4-47cb-bfb4-255108298608", "value": "eb3fb2f071fbb6e9860c1edf846eb9edb1834928f1193e412941e14a5c7de8fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda34549-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786368317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368317, "uuid": "4d7f651b-b449-4dc8-a1ed-6e3585e6598a", "comment": "Malware payload (AgentTesla)", "value": "002cc52ebed4f36696d761d3a85a0b98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368317, "uuid": "897e9325-b4fc-4015-acec-06e1ab9480c0", "comment": "Malware payload (AgentTesla)", "value": "eb5fbcfe41d2968104662024cb45e9b8cc494f00c7f8998bad446335c70eee6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368317, "uuid": "57f30d0a-b61e-425e-81e9-cb891c967bd8", "comment": "Malware payload (AgentTesla)", "value": "612f5eed2055a60578b70854f78f0eefea752d24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368317, "uuid": "129c66f7-5cff-47e0-a347-9b1c096088d3", "comment": "Malware payload (AgentTesla)", "value": "3178deaa2373e11dd4a35eb63b1748d6b8babd2325c6c0dda0cdb6a6eb2767829cd55252fa1ebfb6f2833c22c5c3cc6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368317, "uuid": "5c01fed3-bd8e-4ce0-9a37-0086de3c16dc", "value": "T1EBC4F192B645D123CC1729B49523D6D2C927BC39DAA1C833B1DAFB0F26374E26C6132D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368317, "uuid": "3abc8f0a-4c55-45dc-acc5-5ce5df32d5a7", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368317, "uuid": "bce819d9-6a36-4b1e-8e18-eba361b37108", "value": "6144:sT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6Zg3en2HEPwV1C7U5AIkHDrEXSOMzDz+:sTsAXF28crKGbJZgOn2HEg1CAOfjrT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368317, "uuid": "f8e701aa-cf8e-44dc-ab91-6301c9551db0", "value": 562048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368317, "uuid": "e9b2be7e-62fb-4f02-a0a7-799d4a69cf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368317, "uuid": "146b8cc9-0527-49c0-8b30-f1eeae505a5e", "value": "eb5fbcfe41d2968104662024cb45e9b8cc494f00c7f8998bad446335c70eee6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9269fd4-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372148, "uuid": "1dc0f6f8-7978-40f9-aa00-a9ca391d29ad", "comment": "Malware payload (Formbook)", "value": "d19163775b3dcfbdd98d2cdbe0e985e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372148, "uuid": "483a0a2c-4e1c-46bc-bf6a-4a617e26db7b", "comment": "Malware payload (Formbook)", "value": "ebcad021eacd1f11e99b8a749ff5a9dd70dc833f261427d3374fb841cda28cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372148, "uuid": "f5e341e2-c654-4bb7-a598-63d8eb12fab6", "comment": "Malware payload (Formbook)", "value": "fd3643b2df0b87b1b250161e0ab0e7ff0cb70cf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372148, "uuid": "0e3af09a-99c4-4881-a624-0b11b10e303c", "comment": "Malware payload (Formbook)", "value": "f44b17e7cec52791f4526935e78ef7ec05c21db09ef8a60495c7975230028bb85cc17c123336745fc83f3ae854be0484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372148, "uuid": "6aedd3af-ab6e-4e48-92ed-63b460bf3727", "value": "T1E0352250AA9FC602C65907B289E1F37023BC8FA8F533C72B6BE86DD77A127575855302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372148, "uuid": "856c942e-5f98-45cf-81d2-11068f728a01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372148, "uuid": "85833fa8-3892-4151-a496-df95c49903b8", "value": "24576:ZMZsMLWmmaA9r6zONkTPF46z/0FsXdEmsd2USpXP0mArkerb:hR6Us464FstEmjU6MmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372148, "uuid": "aa8e23ad-663e-40a5-9c89-e1cb0c43e027", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372148, "uuid": "24c40561-e7dc-4a83-9568-4a2c2194647a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372148, "uuid": "c6b7bc6a-c5fa-4cf1-b109-745e7f10cad1", "value": "ebcad021eacd1f11e99b8a749ff5a9dd70dc833f261427d3374fb841cda28cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6408533-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373486, "uuid": "7d9693bb-f250-4b8e-95f6-0eee8791d97c", "comment": "Malware payload (AgentTesla)", "value": "d5ca4de85478656676cb50c460491b96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373486, "uuid": "f65d8d41-711e-46e0-8c1c-14d70f8d874a", "comment": "Malware payload (AgentTesla)", "value": "ebcf6abf9c9aaca0f8ed77276cb8853107ee4d67f7ebf30e321d58190b66f1c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373486, "uuid": "97939067-5592-4832-818d-591676e22615", "comment": "Malware payload (AgentTesla)", "value": "920da46dbb65c6c0edd83426d83893d3f63e67d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373486, "uuid": "442df88b-9cfe-4636-aeaf-7b73d0994832", "comment": "Malware payload (AgentTesla)", "value": "f63d07101c2a211915a366e5f2940fa2b6c692a72524f987503f47cfd7231080381b2f08e3a100973479bee3d2eca4b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373486, "uuid": "049e1e25-6833-4460-8cda-8520becd827f", "value": "T14155ACF213B88558FDA85AFCC4E444104BB37C3ADA21D65D7B78239E1E32F428517B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373486, "uuid": "67f5b67a-62d5-458c-8d71-7ce80147e037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373486, "uuid": "6f897e02-12a9-4610-9ab1-c67a190154a3", "value": "24576:E2d07VES6WanbpA6d8agynZ7t8K7fhkEPih+e4gFhKvQDOL9Fq:ciSQ6yZh/kFMgF0uOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373486, "uuid": "4f0371a2-89e3-4003-9eeb-72f76d436a6f", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373486, "uuid": "51ba46d6-9159-4aae-a2a1-0cdc0ff1f850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373486, "uuid": "2d38b8e1-df24-4e14-876a-872d2136e012", "value": "ebcf6abf9c9aaca0f8ed77276cb8853107ee4d67f7ebf30e321d58190b66f1c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec97c3c-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368292, "uuid": "b4a4ee76-324c-41bf-a56b-64538c7cee1d", "comment": "Malware payload (Vidar)", "value": "f05e9a872e124cf243a3bfa9f0c236d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368292, "uuid": "93cee554-85af-43a0-afbf-2870dac6a112", "comment": "Malware payload (Vidar)", "value": "ec473ac5f43332e074e099250fbfc98755e6ca1d3873d375b314ec87c9dec46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368292, "uuid": "c8b3a7aa-dd5c-47df-857e-ec4744e574ef", "comment": "Malware payload (Vidar)", "value": "fd15c53c149cf19fd5e3eb3c78b5509336dfca16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368292, "uuid": "5bbe0581-5542-4d3c-a7f9-ca7002f50ba2", "comment": "Malware payload (Vidar)", "value": "b90007df0cb0454730195f4d11c0935dcc8bd92a4c891aebcdbdae8018e3d532ef4d788da267a80868e3ec76c685bf24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368292, "uuid": "92a523d7-67ac-4988-b4af-860635846aa7", "value": "T138422A86B156F0BCD069C239DF960677DA623084030E4FFF52ECC7E86A836557679B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368292, "uuid": "358f9e02-3bc5-4f30-9e59-6d4af4b22e62", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368292, "uuid": "42a133d8-c07f-4cfc-ae9c-7a8f22123045", "value": "192:9FBrsSLMPjTooAdTnr35uuNebwO4l28m3Vw2j8:9FVsSLgjsoAp8uNqR489lwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368292, "uuid": "f2f150d6-0075-4410-96a9-465ff3180d3c", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368292, "uuid": "77be4a74-5015-452f-898c-4044e2ba999c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368292, "uuid": "4ae429b8-2ea4-4dc8-8d8d-d699b2a1ad45", "value": "ec473ac5f43332e074e099250fbfc98755e6ca1d3873d375b314ec87c9dec46b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb62c8cc-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369092, "uuid": "b983c0e2-ee57-4419-82ae-ec6a4a322b5f", "comment": "Malware payload (Formbook)", "value": "480118cd69c2896a1981193f2f61b9aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369092, "uuid": "0c2d110b-c70f-4258-b59d-edacadcb58a1", "comment": "Malware payload (Formbook)", "value": "ec4a716ad2ca285373bb7351558618c6d4bbb4ed8c82b1dc1e2542c052635308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369092, "uuid": "f56e8dc8-b709-4ffc-ae1c-6a0ad9c99afc", "comment": "Malware payload (Formbook)", "value": "72b6cc803ab63425257154d27eec4e85cdd7250f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369092, "uuid": "ff777f13-25e0-4a89-8456-5b6dfc4f655c", "comment": "Malware payload (Formbook)", "value": "41f0f5a4a7306a425b70e51d79041900dd930eb4d6669470098015a769f576c39fa03f086b93f116708377879a6e6a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369092, "uuid": "76f646b8-f741-4ee1-a49c-8517a60e0136", "value": "T1DF35020423A4DE06D0BA4BB0ED71D2F053B96D98E862E34B5EF2BCEB78797521414397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369092, "uuid": "c20659d4-bbac-4cf3-a59e-da1c55e5a4cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369092, "uuid": "8a5858fa-4d18-4bf9-8983-6ab37e78be18", "value": "24576:uDZkYeJaUdT/yiSG+4y76GO31mxSz8mQ0AcGMI0z:MZgxdT/yicP6m8zKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369092, "uuid": "e816d8c0-e458-4123-9b09-f2f0796bdbe7", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369092, "uuid": "140fea5a-b1c6-4480-9384-3b0e26298f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369092, "uuid": "a85d7c24-42bc-471a-bbb3-0ef3c6b25d68", "value": "ec4a716ad2ca285373bb7351558618c6d4bbb4ed8c82b1dc1e2542c052635308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020f96cb-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1786372646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372646, "uuid": "20a7870b-6d63-420e-b1ea-117229ddab9f", "comment": "Malware payload (SnakeKeylogger)", "value": "216865a9192016ae1d9ebdf6d1657f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372646, "uuid": "7477defd-3db8-4d6d-838c-b0266d048a01", "comment": "Malware payload (SnakeKeylogger)", "value": "ecb67ac7512c40c667d6ed853630be084011aa5f857f696aeeeaa1a99bf491bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372646, "uuid": "e5aca9d0-6360-40af-8551-35f43696c259", "comment": "Malware payload (SnakeKeylogger)", "value": "5273aac3b4e2a3704aa6a807ba6738cd86466689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372646, "uuid": "4273e9b6-d670-42e2-b179-395ede9b746a", "comment": "Malware payload (SnakeKeylogger)", "value": "16d459f8262dd668bb2b546c5e55e20bc13f0a30d46c337313cc7deab90be60a411c83603ec0070fd4b0e9d7c77f292f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372646, "uuid": "26425fe3-f3b2-4840-9e8f-0eb5799d1ab0", "value": "T16A84BF423D08A5D7ED3D6372296785872FF4787A4B92169FBAABF61648423034E1FD0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372646, "uuid": "b309fba7-a7ea-4105-856b-ffcc834dc018", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372646, "uuid": "bd71c636-83bb-4445-b119-085784cf4dca", "value": "6144:Owq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437Alap40zrcYYo0yEV:OzhufPAgEYFV42erc2/LsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372646, "uuid": "c163987a-a0b3-43aa-8336-09c740fcf133", "value": 388232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372646, "uuid": "6b1af2ee-bb51-4378-b9ce-aa17de323bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372646, "uuid": "3bc64a63-254c-4ad4-99e5-814341c383d9", "value": "ecb67ac7512c40c667d6ed853630be084011aa5f857f696aeeeaa1a99bf491bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a39246-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340204, "uuid": "cf3a6ce5-8b44-4994-8d1a-c51253d6c7f7", "comment": "Malware payload (Mirai)", "value": "cec565a36f2d1af2a1a89b544363c0b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340204, "uuid": "9f5c07e3-716b-4d0b-9174-2ce4b6729767", "comment": "Malware payload (Mirai)", "value": "ecbf67ea1faa758c727632425060786daec1a826c0c74970c44f6ef24ab33dde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340204, "uuid": "f0bb8b78-26b1-45cc-9fa7-a215b9c812e6", "comment": "Malware payload (Mirai)", "value": "cd0b190c56fdacf032fa2816b446d3bad62e089a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340204, "uuid": "095367e6-bd84-4ca5-beff-501e9090ed3a", "comment": "Malware payload (Mirai)", "value": "93148672e5e464fbea74227d1751c2563540ec5fec3b30321721ca046dce1359a90bca62b81612eb7b3de3be2b2885d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340204, "uuid": "7dcbd3de-f7a3-4bcd-9f26-3df4eb9ab068", "value": "T18174ED88B5F2E2CAD1D4EA75B319784D3B530736B1D77146B51EDA3322EF18809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340204, "uuid": "671fb646-df87-4a4d-9d88-04e4818f6ef5", "value": "6144:jQ8a9UOyVHTjcYnKdtceyMgW37JuEHB1zNfGA:c8a9UOkNnKzpVHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340204, "uuid": "5aede239-37d5-4675-84bf-0e46b49104e7", "value": 347576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340204, "uuid": "c725ba70-bb53-40f0-8621-5f24a863f625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340204, "uuid": "d6e187bd-d4a6-4d3d-a9f0-a2195a17bfa2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9776b627-9472-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335531, "uuid": "ba9a3e25-fa5d-4dfa-979e-5a1bb6a0681a", "comment": "Malware payload", "value": "91813a2dd47ab174a8f3dbb49ff8ed94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335531, "uuid": "488d6091-eb41-4f89-bb11-c95df0bad3d4", "comment": "Malware payload", "value": "ecfd6b515fe97e747106d3f44f9f6746f55bd9bb37b149074dd8feb22334e0f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335531, "uuid": "ea2eb336-dce1-425c-8ff3-76afa06b4639", "comment": "Malware payload", "value": "0742a0f3479f4aae4b466fbcebe8f7dd1b972062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335531, "uuid": "b0913e99-a506-48a9-9e9b-ca5313446f16", "comment": "Malware payload", "value": "d6265c81682211fd2150a2f986d7b13a39e509114cf2c6520e6b0a6fa9d6eaedbea26c63b3cd3d53fc05ddd9adaddfc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335531, "uuid": "2b4e2b19-dd21-4037-af45-f7eabf75feac", "value": "T1B523C31BBAA3B47CC24BD0B46A9AD5F1B93178B402213D3FA3C5FA312D35D512A54E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335531, "uuid": "8f9dfbc6-7bf2-4f68-bedf-e8a051f76e64", "value": "768:h6y8n9I+h+ZqquVAy5pY38uCfGbGxgXw3wTXlljpPJ:ky8n9ICpAy368QGxgXw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335531, "uuid": "552adc68-5df3-4444-9512-c61ffe010af1", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335531, "uuid": "c457146a-ad22-4777-b29f-fbfe80f1f551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335531, "uuid": "f9c4192c-8ed7-49d9-89de-f991054f453f", "value": "ecfd6b515fe97e747106d3f44f9f6746f55bd9bb37b149074dd8feb22334e0f4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee75416-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353824, "uuid": "ebe0b986-2439-473f-be35-b31e1b6617c2", "comment": "Malware payload (Mirai)", "value": "6dfa71c7073f5657c3e09d287eb37d25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353824, "uuid": "4c70f807-bd30-4d7f-a05f-e96cafd8993d", "comment": "Malware payload (Mirai)", "value": "ed86991b003547dd3c3ce61e6a04d84082671ca5dc3d120e157a4f5c45f67e02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353824, "uuid": "689b5082-4191-4638-b44d-375b9120b6f0", "comment": "Malware payload (Mirai)", "value": "79095fa4545fc09d56e199a860fbe6b4b93b43b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353824, "uuid": "9f436bff-015a-4a20-8ce3-5244e9a9ea10", "comment": "Malware payload (Mirai)", "value": "a465db4b07d8d3c1e1cc2c611c6854e571f80252ae861a4ee66c97c1fa2e7b2c1b2a0c4a80ab8a1c1d98ed7ebd2a204e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353824, "uuid": "75cc0440-a88c-413d-a977-e6fbe0fca40d", "value": "T196142B02D5504B57C1C21BBABB9B425937336F64D3DB3302AA24BFB42F86BAD1E2D511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353824, "uuid": "b998da6a-f589-4d89-a534-ce7b0bcc1ff7", "value": "6144:/D1vt3yYaau0K/GQqDx4mWltYrZxa5F4sss:LZtCYaH0vjx4mWltYrba5F4sss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353824, "uuid": "b4430c4b-31fd-48f0-bcb1-d480a4803a75", "value": 205314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353824, "uuid": "f418f713-da94-4394-8e04-9b91d218421e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353824, "uuid": "db110403-461c-4c7a-b20c-d7f88e69ba8d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75875cf-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371233, "uuid": "c0aab220-11ce-45a3-a248-a11ee2e6354a", "comment": "Malware payload (Vidar)", "value": "1e6704579e042a225e9a355b88e091b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371233, "uuid": "2627ba20-df2e-4423-a86d-c2bb1fe21e46", "comment": "Malware payload (Vidar)", "value": "ed869e069a4e2f8559672f2d8902a632962338cbc4414fa51eb9d01c7f96b0f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371233, "uuid": "af47621e-6c38-4d5e-b565-6ef6eb0f16a0", "comment": "Malware payload (Vidar)", "value": "f427465d37b5bf12d7ba9e153b03d0eaf51398d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371233, "uuid": "d253c16a-42ea-4af5-9b6e-e195efe901d6", "comment": "Malware payload (Vidar)", "value": "0837d7a8a0e2dce481719c0e30a2246193c4efe9d11af2c4141283e68d94e68fea285d0d63cbdbed1407100d49e2f9e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371233, "uuid": "b4964ec5-3f6d-40f1-ac1a-97d2b10f190e", "value": "T1E1521982B6C1D2F4C466C339DA63117396B63844513A5A7F3B5D60A99FC1330ABB87EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371233, "uuid": "428347e4-b795-4e00-9b3b-4c0defcf18e4", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371233, "uuid": "13898eeb-1c99-4f24-9b37-b7c7dbf61cff", "value": "192:OIwBgM1Thbf+jMgwLae3d5obEubkLwFd2bezopRiijg7mX1IPfgrwPS3V6cD:OIE1Set2bExwFisuGPfgeSl6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371233, "uuid": "6a106c1f-4f55-4cad-9c9c-9fec246af4e8", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371233, "uuid": "bcf542ec-a668-4ccb-82e6-9e584c93cde5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371233, "uuid": "52a2c9de-2c82-4757-bc34-8b735ef9ff00", "value": "ed869e069a4e2f8559672f2d8902a632962338cbc4414fa51eb9d01c7f96b0f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2959d834-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370565, "uuid": "9c72ba4d-9ce6-4e32-bc40-9057df2f43e9", "comment": "Malware payload (Vidar)", "value": "5f5549dd3cfd8d600e81cd5b39b03e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370565, "uuid": "4b90d0a9-72a1-424d-9d7f-3c0571f3efcb", "comment": "Malware payload (Vidar)", "value": "edc92992240e52f2e51d3cad69acde5167723c95160fa706b2919a22a1d68dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370565, "uuid": "d68d1f98-96b7-4736-a021-e1790ad3c119", "comment": "Malware payload (Vidar)", "value": "d58e4d5462ec3fd18997095ed2622b9bd87af56b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370565, "uuid": "f7e1881f-7928-48cd-8a0b-842f15a27ca2", "comment": "Malware payload (Vidar)", "value": "d46f5e4eed3d891e46d39f6127f11c92823ac815048538ab47a04ef1453fb1087f5ee272ba38e7d7187f458db6f966c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370565, "uuid": "724c55d5-5b70-4beb-ad9d-5413952e7cd7", "value": "T101928084E51B9AE4C4E1C336A366525765FDBC612231573BABDCAB3B0D42330AB543EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370565, "uuid": "5d0891cf-75ec-4942-8276-45036f245d44", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370565, "uuid": "15a73ce7-33fb-4832-a876-6fe1cb0a40a3", "value": "384:q4tcFqOHgPPpcRdKjJQdutDVvQzvyLjgNBZsLnZValw:ZQADjyotTjgNhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370565, "uuid": "2f9af228-9524-44f0-8317-ca9afeec0a74", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370565, "uuid": "5129fe1c-fc7c-485f-af75-3521d9cf85c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370565, "uuid": "5d5aa823-6f54-4a32-bc99-87ff9e0d5fd8", "value": "edc92992240e52f2e51d3cad69acde5167723c95160fa706b2919a22a1d68dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0101f717-94cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786375222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375222, "uuid": "28933662-6602-4d8d-8786-37e99bceef95", "comment": "Malware payload (Mirai)", "value": "ba45e1276f0860934ea9aa557e87cf1c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375222, "uuid": "0033e33b-1830-481a-b546-6397521571f1", "comment": "Malware payload (Mirai)", "value": "ee5a675efa018c0679a321c2de42fd26d7440f5cd904f772c84e0f744f459978", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375222, "uuid": "520284ee-bb92-43ac-9aad-8cae688bee79", "comment": "Malware payload (Mirai)", "value": "3846e6a26793ae43d289076e3895cf2632fd688a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375222, "uuid": "622af8dc-88a6-40bd-ae61-9b60e795e4ea", "comment": "Malware payload (Mirai)", "value": "dcdd3311be5ac0ee31a2073ac6153236f98d46461e3df38b6a37f3d7d5279c482aef7564a183f14915751d4ee13fc2c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375222, "uuid": "a05c2ae7-d6ca-4a30-bc98-084d8ce4c227", "value": "T15FA1E48A2470D73CA86FDE6C79E54B40988945E232B23F3A9EB018571CC9970B349F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375222, "uuid": "d00f3d57-c13e-4ff2-b3b1-f0d9184454b7", "value": "96:jll87v5iTLxr6yAh33oJPujVyC65nn42Q7dA2SPB0LaTm/ViVXhIxF14px8fTcdd:jll87v5iTLxr6yAh33oJPujVyC65nn4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786375222, "uuid": "1fcc2e8d-6747-4d8b-9af7-bc356532962b", "value": 4837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786375222, "uuid": "dffcbd80-f4ca-4687-b36f-e6217e516ee9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375222, "uuid": "3bdc5eed-f757-4f48-9736-e41c190c1ddc", "value": "blink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1826cb2a-94a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786357222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357222, "uuid": "a68f524b-3e27-4b8b-b145-5b2ea6ad1b00", "comment": "Malware payload (ConnectWise)", "value": "a65f533d10703afcd9cc1210ca559b75", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357222, "uuid": "b0be06c9-fd40-4d3e-b138-8b505e231d67", "comment": "Malware payload (ConnectWise)", "value": "ee8bd9222c943d35f0702143c7606aef6a62b229ffc109a468537322e917a9e1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357222, "uuid": "3d26be09-e3ea-41cf-a062-d7977ff8bcb2", "comment": "Malware payload (ConnectWise)", "value": "2ac9f75fc9bc14e8f57e319630c3f9dde3a814f5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357222, "uuid": "9fc7e188-d6e7-4f12-951c-1c77c67d431d", "comment": "Malware payload (ConnectWise)", "value": "29a5a81db583426fa2a28a94c953795be6b2696ead69db9f9f495a884373012ccb221425e1b555453152ae3cf8c7e240", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357222, "uuid": "15a175f3-a6c2-47a3-8bb5-93d373605d25", "value": "T10E46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357222, "uuid": "80e9f375-f364-437e-8564-fb59a9ca8d7c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357222, "uuid": "32ab41e3-672d-4d79-85fa-65712b92ef8c", "value": "98304:6zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:6hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357222, "uuid": "4a06e511-5289-4bf6-856e-b4236e3e3143", "value": 5641544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357222, "uuid": "2942288c-0ee2-42d7-a0be-816472a6c86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357222, "uuid": "23a73cd1-42a6-40cb-8a7a-c884d4620b3d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7133da88-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340191, "uuid": "c90b3169-7384-4108-86d2-2120b3db929d", "comment": "Malware payload (Mirai)", "value": "28f94d792537bb68a5f8c51b02911b0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340191, "uuid": "a65f99b0-e316-4ab9-a0fe-f0cdc7709daa", "comment": "Malware payload (Mirai)", "value": "ee92614e5e2380c22018e29af743783a81188f865060ed28cacd6857c2b36d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340191, "uuid": "da4096ac-120f-4f6d-a4bd-244ccfc8bfc2", "comment": "Malware payload (Mirai)", "value": "79ee7ac5d8d19818721d2fc4400ab0cde981ef0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340191, "uuid": "a98eba75-4bfe-4c4e-abf6-b5e7aa21b157", "comment": "Malware payload (Mirai)", "value": "e13af32f479f67ddf9071a87991e2207a3d5cc02ae46b7916ed974551f7c45ba318d07e06001bed5b0032e853d488566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340191, "uuid": "1bf9c216-298e-4dab-91a8-b2b1abbe8908", "value": "T14084EB8CB5E2E2CAD1D4EAB5B31D784937530736B1D73146A51EEA3313EF19809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340191, "uuid": "70baa934-33eb-442d-8618-e64ef45a8335", "value": "6144:Ga9za9Aa9iG028/apHgRJhpsallftd89gC1Q/Eth:Ga9za9Aa9if2bHgfhBXtJC1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340191, "uuid": "129705d1-54ae-4c3d-8f27-5a4d1ce8b0d5", "value": 374052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340191, "uuid": "422f6bf6-e66d-47dd-a501-e01f05872a9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340191, "uuid": "5a8e41c6-1330-4cb2-bff7-11855f30d6b2", "value": "pid.ar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13445eb2-949e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786354207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354207, "uuid": "0c9772f4-3c29-40ba-9dfb-0ff16d0df0c0", "comment": "Malware payload (AsyncRAT)", "value": "c39c47ddef43b8bf7807d1c687bb96d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354207, "uuid": "4d011c34-16ab-463a-bb9b-994bccc31858", "comment": "Malware payload (AsyncRAT)", "value": "ee9918abc39d7d0b46c5cf7891f5b845d0ae5acc0e88f22ecd6ad19099260651", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354207, "uuid": "806583e9-8f60-4f3c-8b7a-c29dfbdb0cff", "comment": "Malware payload (AsyncRAT)", "value": "07d5555319bf035603ae336a6c6876ff6deb8dd9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786354207, "uuid": "f4672358-1d87-469e-ac6f-0f8ff07f95c4", "comment": "Malware payload (AsyncRAT)", "value": "ddc82cd144bbc4b98d7e8cda70a6ee51a3e1ed5f07bf329f26e8026adb706428702e13af5ba2e08152da707eaf7b3cb8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786354207, "uuid": "2eea6c05-ab4b-4125-a3fd-28c863d61a2a", "value": "T1F5269E606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786354207, "uuid": "f483b707-0ed2-456d-828e-ca8867d09096", "value": "24576:t/ZWLuefCM8p0jgLFmAJUO5IrsO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm3d:4BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786354207, "uuid": "5814426c-2c85-45a8-b784-e964875427d5", "value": 4551333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786354207, "uuid": "eb70bc82-bcfb-4aa5-9ace-e53bd93d11de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786354207, "uuid": "9ef04730-3cc9-4729-b4f2-ea38777b6694", "value": "RefundIntimation9387943.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8b244a-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "96b8514d-6b45-419e-8b57-b42503e48535", "comment": "Malware payload (Mirai)", "value": "879dfa01c1ee310164bc29af9879358a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "53a56ac8-dd63-45eb-9bf0-b3735278d4c9", "comment": "Malware payload (Mirai)", "value": "ef442563aa793dd743df22aa8f85a65527949f43972bed8ee2ba14ecd3c017bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "39d346e7-5673-48b8-9234-1d4d778305bb", "comment": "Malware payload (Mirai)", "value": "0307c6009b79f4cb8a6a34404a48e041ed9c591b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "385a5794-8643-4718-802b-da8ccbd76a43", "comment": "Malware payload (Mirai)", "value": "571776fce89f0afcb24a37007dd63afa911f5e3bf4f9f7f4ab8549b1175f77d81da637c6b6b6bd4d3b6af604b59f5229", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "e2f09de3-ebea-4af2-b91d-ebe2d5e4e18c", "value": "T1447301A389621E5BD89714F854290780FBA398E83327A43A276CF915F54087DD47AE3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "3c1ce2e4-13cf-4264-8475-e7bac9ef64de", "value": "1536:qPTW1RkZHLSaoS2bkQz08gFAa7va73bph5JU7QkGU+UdhFWovsTlSOQb:q2R0HWaoS1N8RDrlhM7Qu+A6o3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383589, "uuid": "6728fbeb-29ab-4f80-9db6-f7db071adb03", "value": 79840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383589, "uuid": "4e1e2206-f8fa-4a12-9a1c-c61c08fc7082", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "b58b64c7-3021-46df-b14c-e77a6a577641", "value": "disconnectraw.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931772bc-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368595, "uuid": "c9db99e7-a292-4f4a-b131-72a6921c2844", "comment": "Malware payload (Vidar)", "value": "c5f15360a692a036176e585fc26b6e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368595, "uuid": "bdc7be62-75ce-4c13-800f-27e87539a341", "comment": "Malware payload (Vidar)", "value": "ef5036945110a8265442c70e03d147574436a0150d5cc412484ce103672d22ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368595, "uuid": "0ad9a8da-976c-4767-9b92-d05ced4cf2af", "comment": "Malware payload (Vidar)", "value": "5df0e45caac9d5be1b8f5371ec135e39bf4f90ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368595, "uuid": "7ab8f626-46e2-4dc6-b7d5-26106b1f786e", "comment": "Malware payload (Vidar)", "value": "a9f513a75eb7f9e06dbd6d01ee1dbc2c2386f8cc0147a25402f80fedfc498bf16d2b60c146c6d233f39107534152d621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368595, "uuid": "c4d9e5dd-9a75-435b-b8c5-f5545b50cfb1", "value": "T16242F78731E3E0BED57E82B4DA6B71BBD21A3085071B5EFF05F8D5A46BC22203176664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368595, "uuid": "1647ea6b-6f3f-4580-bdc0-2ab67cc9a66d", "value": "59cb60c885016941339b05884618f82f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368595, "uuid": "547f62a0-8ce4-46f0-b41f-8efa6fa5a672", "value": "192:OMJBWi1cJvv38Xdojo00Tl3dZQEOx0xcC532kI2Csm+5mCty7+w4EDBt7G3Vazpf:O4BWi+dvsXCjoN3dZ3aAB1v4PvxBkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368595, "uuid": "91084501-4e0d-407c-b76d-84d5deedea56", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368595, "uuid": "c74cd7d3-ecf4-491e-9aa4-12f4ca081ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368595, "uuid": "554ee48a-07d0-4447-9593-7c662e77fed3", "value": "ef5036945110a8265442c70e03d147574436a0150d5cc412484ce103672d22ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24227b4-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786346367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346367, "uuid": "76b47ded-c943-4aac-b552-3f9a64b8e1d8", "comment": "Malware payload (Mirai)", "value": "885f4b59490760401e33a413bd4b3b08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346367, "uuid": "344837c3-8d10-4c32-a4e5-c19033fb05b0", "comment": "Malware payload (Mirai)", "value": "ef55b5ceef9c7d47282c270b3a27e007b8996fbe66b032b28936c100a9655e3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346367, "uuid": "5e333ed8-78c1-4fac-b125-ab17befd2166", "comment": "Malware payload (Mirai)", "value": "33d393a51c7eb2a5ff5bf6f15a5b793d54c102ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346367, "uuid": "6eb1cb39-0eb6-493d-b24b-4d8f40f5077d", "comment": "Malware payload (Mirai)", "value": "9d7d84849ddd24a4b5e1634d1c66a81efd911683691295196c97cf061d9ac9b9d69265102ddd2dc9a65021af8f9cd58e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346367, "uuid": "5f73e680-ca90-4594-8199-9972a79f0974", "value": "T1C084FD8CB5F2E2CAD1D4EA75B31978493B630736B1D73146B50EDA3312EF19809BDA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346367, "uuid": "ac933cd5-d0c6-4f5c-a74f-34a336b72070", "value": "6144:ihlYa9szsODsj3HwnB/v27S4sKJeXyQfQYkf/7:ihlYa9sIOKwnwNQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346367, "uuid": "55338830-48b0-4644-8847-5862a8b4611e", "value": 372328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346367, "uuid": "034a2571-90fe-4679-9cee-2fd3ce89aba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346367, "uuid": "ce1b9b3c-9635-42bf-8fe5-3f5760161e7e", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16c73e8-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373773, "uuid": "8bb5fa90-ed5b-4f1c-845c-e8c22abb0300", "comment": "Malware payload (Formbook)", "value": "907a14c848304e9261663658f1087644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373773, "uuid": "0c289643-96b8-4711-a698-0fc48cf50003", "comment": "Malware payload (Formbook)", "value": "efbdd2173551cae0bb7f56fcb88a0340fee48e4bd4fca88daf3c1ab7c96a4cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373773, "uuid": "47815f0d-bf79-4b42-93bf-96c3a841668e", "comment": "Malware payload (Formbook)", "value": "7ad7baf882b44ea3a33a0da03bf1e6c0398d6f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373773, "uuid": "b91af765-77d6-47ce-a8a1-6cd7d01598be", "comment": "Malware payload (Formbook)", "value": "87d56dabb96eaf94666dee080b635ddc048839ef993196b4694964561694e1adf78dcc56f2c27403daa57bfc79222ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373773, "uuid": "ad2ea0aa-f8b5-4913-9f6b-38960fde3b59", "value": "T13425225532A38702E8776FF508A6E83157B66C9FB120D60A9FEC2DDFB44A7445D023A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373773, "uuid": "2c7e7a0a-f618-4e8c-95dc-e999e1e79812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373773, "uuid": "0eb653c4-ff03-4e93-ba77-f0bffec9b0a5", "value": "24576:H6U44Lkt/cINsvEm+3XD4uu9asTabnf7RPt9xyR75UB:H6kLkNLNsXa4basTAndPtA75UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373773, "uuid": "a630fb00-4c18-4768-87e0-5b53e48715dc", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373773, "uuid": "8e010656-877b-45a3-9133-d64e63485ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373773, "uuid": "b3152e9c-ee3b-48d5-9528-ff908bf7f7cf", "value": "efbdd2173551cae0bb7f56fcb88a0340fee48e4bd4fca88daf3c1ab7c96a4cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02ae303-94ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786396104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396104, "uuid": "9e45809c-5f3b-4f5c-a61d-2d5a2226ba01", "comment": "Malware payload", "value": "929756637b54d0ef987a62e651bd17fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396104, "uuid": "6376a398-2176-4902-84a9-aeb7a3f34ebf", "comment": "Malware payload", "value": "f02185a5ba09bca1a19ea209d1acd293b6fed4353142ab220fa75e18e60b0831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396104, "uuid": "5d96178a-2fa5-485b-952b-412b497b9b6d", "comment": "Malware payload", "value": "3227dbca73bc1d3a26e1804b8eaf75c3a5cb5391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396104, "uuid": "84e97b73-f47b-47f9-a206-af72da7c03bf", "comment": "Malware payload", "value": "8a17360914b521cce90326c10dddb5d6933c6ac5449bfa8cf5c10f72391d5be000ac22e960d63b511e92cc00f17f49c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396104, "uuid": "a5604d7e-2006-4745-b59c-fd8e99b516c2", "value": "T17C53E75BB6E3B0BCC287C0B45A9AD5B1B93178B002213D3FA6C8FA312D35E516655F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396104, "uuid": "b9de7efa-b3f6-46d2-964f-f2c9425dcd06", "value": "1536:+F9m2PvAQ55J7IvD2QQXJvaSlqXROqrC5Urg:+bPvA4J7IJSlMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396104, "uuid": "03c4961f-650d-4203-a06f-413affe22235", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396104, "uuid": "e0fe250e-979f-4777-b681-801090632e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396104, "uuid": "1e2aa3c4-c8d6-45a3-a827-f5506abe85c8", "value": "main.x86-64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934e7810-94a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786358717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358717, "uuid": "c791d0fd-0d7a-4153-aed6-6187b646d708", "comment": "Malware payload (RemusStealer)", "value": "fdb6448a3ac57e511a53cda07945be8f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358717, "uuid": "a713df5d-9123-4bcc-a538-d52480a1de18", "comment": "Malware payload (RemusStealer)", "value": "f02eb5040f50f5bdade4c2a2114ec43c33bdf4a7fd9051f9f7d411eb50b1474e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358717, "uuid": "b9ae3d20-9ee1-4019-b2b4-526d503cf58e", "comment": "Malware payload (RemusStealer)", "value": "35170d38f2089910e6dc71ea9a2fd202f6dd2736", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786358717, "uuid": "78070fd2-0a1b-46a3-9905-9197749a988b", "comment": "Malware payload (RemusStealer)", "value": "48db77f0f8f3d5fcebff6aa1bd84fda6cf010483597752c114b466c556906771093dbd17517def434aa7a4084f57383f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358717, "uuid": "553774f0-2f4e-4146-a2b8-47440a8389d4", "value": "T1BB163338BEC257A7E71172BC7D9D1984DEE35CC1138B8A462A4F40885F69FCA47432A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358717, "uuid": "ef2fd6fb-0ad0-40d5-a201-4794a71504be", "value": "d9c0bfb4053066384ee7484b4c2917f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358717, "uuid": "6ccd504f-8db3-4d75-bce8-486da2c1c33a", "value": "98304:/b3osRj07odi0u2/r28ooycdvb5aRaFeGzTl7ez2Il:7DkoVuwravcOgFegyiIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786358717, "uuid": "b21dc2bf-94bb-4df5-be59-5baeb20add92", "value": 4277336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786358717, "uuid": "04968a0c-5299-4dc4-84cb-04b987ed8cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786358717, "uuid": "854d8a92-9414-48eb-8301-5e3cab2464e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e5fe06-94ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786396106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396106, "uuid": "2d583e76-5431-41b0-9025-d5ef630d324f", "comment": "Malware payload", "value": "b822c68684f64a3364a1aff455aec805", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396106, "uuid": "4f7fc733-542e-4a54-a27c-9344743520f3", "comment": "Malware payload", "value": "f07c4a77d4fc2212aa4df0399c4c8b235ffcaa0fc25374718225cd0c448c3aa5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396106, "uuid": "15280555-f3a1-4e41-af05-07c9f36afa6b", "comment": "Malware payload", "value": "0510dbfbe701bd48f6ffce5dbb34a59316641ca2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396106, "uuid": "9915dfc0-92f7-480f-8482-5a934f9c7a50", "comment": "Malware payload", "value": "7d2d3408179fd894ac8d15eb2afd6e3a7f5282be55e6a35b7f4565ef43ad0a0fadfd15e826109d17695962adea98ea5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396106, "uuid": "929dc879-18b4-4f7b-a3fc-cf925343a532", "value": "T1C6236C651A957C149A98C4371D7E2F0CB9A943E6320452EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396106, "uuid": "aed69998-c3b1-4f59-9645-c2a16a8d4c6f", "value": "768:+VEJVIhtMi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:cEJ2Mncr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396106, "uuid": "3baded69-91e1-41bb-9850-bc559bc4719b", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396106, "uuid": "3574fc5b-7318-4175-83b5-74358ca151da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396106, "uuid": "8ae80a84-7e16-4e1b-b90e-780372db37f5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a5e7c8-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340059, "uuid": "1a8a7299-ca2c-4d4a-a1d6-514567301a4f", "comment": "Malware payload (Mirai)", "value": "ce79718e8cfc78395251bc4e082e54e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340059, "uuid": "0f01858c-056e-4276-9344-52cbc69aae27", "comment": "Malware payload (Mirai)", "value": "f145b0ade585b3d2cd61e8033471e9010931cac95487e1ddb62a578056a55fcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340059, "uuid": "03093a9d-67a1-4bfd-a3b5-2c89c9dca490", "comment": "Malware payload (Mirai)", "value": "e9cbbf6bd96098c291f3f77f5e5178600434677e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340059, "uuid": "a4fc72dc-713c-4bdf-bbc3-6a7cd2ea8364", "comment": "Malware payload (Mirai)", "value": "690d99b347988bcae830bbeabd986964a45edb2b29ddf04a32ea25aa96ee9f39812f60956c1671c41a6689a4f9087079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340059, "uuid": "ec93621d-3806-4b0e-ac14-ccb540a7ddda", "value": "T1B574EC88B5F2E2CAD1D4EA75B319784D3B630736B1D77146A51EEA3323EF14809BD920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340059, "uuid": "20a998c0-f646-4119-9e21-c3c8f1104df6", "value": "6144:yf0a9oo7kpaeyvawKFIQvK0r4VGC+VTHt6:K0a9oo7kE0zCVl+VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340059, "uuid": "37ab4e72-9272-4b96-ba0a-4b79b56c5199", "value": 342080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340059, "uuid": "d563bb08-935d-4bf7-a619-11ac99c512ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340059, "uuid": "20985d01-dda7-4ee2-ac84-ece2b9546334", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf84d74-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786394863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394863, "uuid": "58dc85ab-127a-4fa1-ac6c-bf453df4796b", "comment": "Malware payload (Mirai)", "value": "3d800efdd751a4760484fed8b0a02d98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394863, "uuid": "e994efc5-c6a3-4a66-b758-46f2896d9087", "comment": "Malware payload (Mirai)", "value": "f18c30ebb4114014c99b35c9a9811d0df7929b48977135a1098396c32a2bbb03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394863, "uuid": "479445d0-b92e-44f0-8f76-c722228c7730", "comment": "Malware payload (Mirai)", "value": "919da8f34e716cbfc6122dd7ca2b8b0341afc037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394863, "uuid": "bf7b828f-6669-4211-a696-b9cbb53c971b", "comment": "Malware payload (Mirai)", "value": "b23bdd07668dd8e2854fa50e9548dc4a2c889f0e70c078e68f2bd42d6465e7717c3c10c07b81a624442fade001721115", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394863, "uuid": "841cfaaa-229d-4b05-acfa-26ff9a9ddc6b", "value": "T1CD436D22C9FD9D46CBD07A7A03E703E3D2CA9B5843D8CA4EED941F698F467104C57A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394863, "uuid": "bfd9b2da-65e7-4241-9a00-fa74603604db", "value": "1536:Dt6r9n4nrWv3r9n4nr9y2B+q1laJaJ3Wl0gkZxBQciGF3bdaI03C:R6r94rq3r94gk+MlgaxWl0zaL3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394863, "uuid": "a95c4587-4fa2-42e2-bde9-6c8138067460", "value": 60092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394863, "uuid": "4c9ed729-e269-4e35-874b-6b749f766b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394863, "uuid": "e4944f5b-fa4e-4900-af1a-79b73abe4932", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66040faf-94e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786385270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385270, "uuid": "878a3714-be56-43bc-a385-f36530aec54d", "comment": "Malware payload (ConnectWise)", "value": "dbb442fdccf20151d463e8ceb2be6b51", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385270, "uuid": "79c289df-ac02-4a3b-b98b-7c52d40c5ca1", "comment": "Malware payload (ConnectWise)", "value": "f1faad45e97dea697036ef3fc141ee1b8259a80f773da7927f9c8491481c3c7d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385270, "uuid": "0bb2da32-8b07-42ee-8d38-de960d6d2fd0", "comment": "Malware payload (ConnectWise)", "value": "43e774b4a5b2e115543af0677203edc85f2a747a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385270, "uuid": "a6fc4868-c918-4fce-8454-4e240c12caee", "comment": "Malware payload (ConnectWise)", "value": "416371f6e8e4f8a373f3607a1be99c08d62d7f3d7e5d593e576a81d6cc59c2c0d88e1105a1eec3b661e1cd11797c0ecb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385270, "uuid": "560cebe2-248e-47b7-a3be-676f8e84c9a7", "value": "T14D46E002B3D695B6D4BF063CD87A42A96674BC044712C7BF57D4BD692D32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385270, "uuid": "80a5e38f-24bf-4182-9a61-0996748c41a1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385270, "uuid": "53165001-17f8-4994-835f-e4824a4302cc", "value": "98304:Xzs6efPhFFNUhJFF3s+BoiGg1Gc977zbt:DfefPCFF3bBR1H9773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385270, "uuid": "d5b8e492-2940-421c-b78b-97a0442a5153", "value": 5637752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385270, "uuid": "84784b62-6ea8-420c-bfce-c59819ac1c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385270, "uuid": "63943d1c-e716-41a9-b40b-6d48f0f14c3a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf8ba4d-9500-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786396421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396421, "uuid": "5747db6d-eecd-4a5e-9c67-7a7e84a8675f", "comment": "Malware payload", "value": "eca5ae1367dce417229148a176d72726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396421, "uuid": "2fb9f793-e70f-419c-97fd-0278b0e2953a", "comment": "Malware payload", "value": "f21e839dfc0b5ddaa49a384a046a8a14682e84437f7cb864909d3b58e495f445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396421, "uuid": "ddad1cff-886e-45e0-8306-99aed3cf192f", "comment": "Malware payload", "value": "4ba85cd2df329b965677ae5b72b81f7a83c6e50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396421, "uuid": "d032c12f-abe7-4ecf-82ad-7011cae8035e", "comment": "Malware payload", "value": "86022488bf1d2083fec2553daf16cc4a21952982b2cc0c01b8b6746fc2a55438301214802864fa97e39bfaa4312fedb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396421, "uuid": "66c45403-fa9d-4201-a040-3961e0210d27", "value": "T1D0A5D03FB28B753EE06A5A3A7AB6E210543B7E61A4134C1696E4E44CCF350B01D3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396421, "uuid": "0a19e38e-0699-41c5-9a81-0251c4f6e617", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396421, "uuid": "148ac888-afd3-47e2-9686-986c442cace5", "value": "24576:yXNrSLScusMmOvjjhzvLJz23AawLR9DC+UmvcnYTn0eaR+rE4mUzJFZhYJLchaf2:9uI2hQILR91jUnc0r143zZ+vFOoljU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396421, "uuid": "d7d9aa5c-d11c-4bf1-9565-fbd711d7ba61", "value": 2186048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396421, "uuid": "29d85032-87be-4efb-8386-98de84b7c249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396421, "uuid": "4e5af249-f32c-48dc-a4dc-f55ea2380431", "value": "f21e839dfc0b5ddaa49a384a046a8a14682e84437f7cb864909d3b58e495f445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a00ccd-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373996, "uuid": "c6618b15-2902-4d05-a451-a01f6d47dc31", "comment": "Malware payload (PureLogsStealer)", "value": "99770d39a3e58d76546cfa08607a76ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373996, "uuid": "0c779393-7811-4048-a2ad-a4003cf6d878", "comment": "Malware payload (PureLogsStealer)", "value": "f2558c75cc829a1a2e6b3ec23d4062be0c6125170d992874c38be9b0d28c1843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373996, "uuid": "8aa15e4a-85c7-425e-82d7-9fe7fa9038b7", "comment": "Malware payload (PureLogsStealer)", "value": "e287602b99de00a3a4e40d2f996b9d5d9487bac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373996, "uuid": "96ece656-40a3-4a96-867d-f2f8900ddc62", "comment": "Malware payload (PureLogsStealer)", "value": "b2b26b6fe498eced38c61b84deadc6d79c596500712890da60e37229c4cec07a03e7381bc0f3915aa9707ff8dbf9c6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373996, "uuid": "aee6104e-004e-4d8b-a3c3-954634736950", "value": "T1FEC5DF25E3D902A8E577DB74CB619332D6B178560731E98F0688D2152FB3E90AF7B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373996, "uuid": "971b1028-c16c-467a-ab83-0bbda784d1c9", "value": "ddd051506cfe33d151858512722b97b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373996, "uuid": "b3861093-cc96-450b-bd83-a82e57ae040a", "value": "49152:AcGxlbuXCqP46udgq5Jk0wwUXh0UMjpfio+sk1pzM:37w9CqTpfiop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373996, "uuid": "40ebf4d5-d309-4fc8-87a9-9413f0d53240", "value": 2585088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373996, "uuid": "ab9db29e-cb07-473f-a638-cf2e5f261712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373996, "uuid": "568b6334-471e-49de-a4b8-ea5f20b78262", "value": "f2558c75cc829a1a2e6b3ec23d4062be0c6125170d992874c38be9b0d28c1843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd49da13-94e4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786384664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384664, "uuid": "549575d9-1ed7-4c9b-8494-c0e297be0dbc", "comment": "Malware payload", "value": "c8067e82104f218f373c68c8cfeaa338", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384664, "uuid": "112e0f39-decb-4292-9e8d-d6537e28d75c", "comment": "Malware payload", "value": "f28ea9198cdec37aa2810d7d725f2b3e90a9ea6d9b6722fccd6ae2bdc4416b91", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384664, "uuid": "023fed14-1fcd-40f1-b389-172d79f93e0c", "comment": "Malware payload", "value": "d1c41315d0b77c541b366ac8535d76ca1932e4c5", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384664, "uuid": "5fd9e884-2138-46d7-9428-9ad14015e285", "comment": "Malware payload", "value": "b09ad3e5bfb17b95a12b4aa0d458ba2b9100b874c5564bde72658d731cc55b3b5fa835afc4a49530e25ebd69cf3cb62f", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384664, "uuid": "3109a921-2afc-4404-a475-0cfe83ee21da", "value": "T1DC0611237F00D142E0262E70DA75C7F993A5FC4CDE56939730E6AE2BBCA96D25D002C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384664, "uuid": "ce9824e4-db8a-4d54-8bc6-3e8fc4ed3b24", "value": "f351e7737381d4efaa62b6557157d942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384664, "uuid": "03f67054-8b87-4e07-9a11-3ecd55d2ce81", "value": "98304:dIEgdit1oN9NkvBCxYuZHcjGT04nM0/43fV7kp:GxiW4vBCxYumjG48bifV7kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384664, "uuid": "0e4cc520-d3e8-453d-967b-fe2d808c1d0b", "value": 4009840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384664, "uuid": "faa53d84-fc1d-4176-ac61-a4462853a1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384664, "uuid": "81137823-4f21-4efe-aeca-50032c12870d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffae46f-94f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390306, "uuid": "88fd1031-b3e2-4ac7-a330-1c15786d53ef", "comment": "Malware payload (Mirai)", "value": "374729d4967a95fc873f7913d18c1f0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390306, "uuid": "6b6b3d30-9df7-4be6-8969-8d639e3945dd", "comment": "Malware payload (Mirai)", "value": "f29b6dc485be471c02c61bdaa72fb2fb3d365e53ae6cec3a2edc027a6cc6d822", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390306, "uuid": "a0ad98a0-1a17-47b4-8b64-73e63ddaddf3", "comment": "Malware payload (Mirai)", "value": "4440adbf51a0d2ddb7be8eccec737dd6ecb1da10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390306, "uuid": "f878bb74-89cd-4bc7-a744-da7143c370a8", "comment": "Malware payload (Mirai)", "value": "a8c3adb0bd90ef30a66ee75761468088c85cb349944689e1a8ebf75798910561f25b3192fc2ef4254a08b8466148b88f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390306, "uuid": "5084a7f5-aeea-462c-ab5b-5f178d9d6469", "value": "T13DF33AC7F900D9BAF80AE3374853080AB130F7A654925B732257357FED7A189147BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390306, "uuid": "80cab510-0d67-42d1-846d-9116414a2b0d", "value": "3072:vTU1cOXB0A9BlgrFywm+imzEmSDBrrTdP/PVejbiHL6gIIVZKD:vI1HF/IywJimzZSZpP/xLlfKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390306, "uuid": "4f23275c-9531-46da-9793-c98c00cb42db", "value": 172472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390306, "uuid": "93f0073d-3540-4a34-b8b7-29782700e69a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390306, "uuid": "2a38f0a5-90e0-4e65-98d9-b6b60cec62c4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f972575-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1786373179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373179, "uuid": "28ef31ab-69ce-4d88-91c2-7e490be65f12", "comment": "Malware payload (SnakeKeylogger)", "value": "516ac57a8704799ecd457fe25b4cd614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373179, "uuid": "1add2ff7-20be-4dd1-b866-bd002c325b01", "comment": "Malware payload (SnakeKeylogger)", "value": "f2f79abe9274166412aeeca7de2eb13139ec4a18e00fa76ffdda8fd185f0b126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373179, "uuid": "ca7536ff-b6c8-43c0-a5de-3372a8ff03c0", "comment": "Malware payload (SnakeKeylogger)", "value": "6635092fcc31fb1196086631864ac485cab29041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373179, "uuid": "837b4d05-632a-4c69-baac-ce155e778b76", "comment": "Malware payload (SnakeKeylogger)", "value": "887e4f3ede8fe36735b378a9aa99de372d4960bdf9af93a566462b64d2800bcc325b76f0919fbf8f064c2260110367fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373179, "uuid": "0c10c71b-22bf-4f04-a065-4261d800bad2", "value": "T1FEA423040E7CCA3ACB685631B96356B92D30705A4CA5D0D7C5CA95EFE34AF5B0D9CCE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373179, "uuid": "3a481cdc-a631-4e47-8a47-b7b1b9d90ed9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373179, "uuid": "3ad4ad5f-c338-432c-824a-4c5403cc1403", "value": "6144:l7o+heTIjBsHmS3AymoyrtbOR8QdqRBbbbOiGrieBcLDcKRiYEm2yz8PfZZbirju:m+hemBzS3Ayx18Q8rbWGmOcKRJpkrbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373179, "uuid": "45b2fba4-2a28-49ee-9743-413dd57aa45c", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373179, "uuid": "c982a6db-d3e5-4402-a1e6-8d1c58ab6a11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373179, "uuid": "4a9bf6fe-0abc-4ac1-8d45-88cd62e52c10", "value": "f2f79abe9274166412aeeca7de2eb13139ec4a18e00fa76ffdda8fd185f0b126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd85100a-94bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786367834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367834, "uuid": "d9a15d55-0e54-4372-b30d-f7313cd6d566", "comment": "Malware payload", "value": "d4b4523d9ba975f85754145853686df7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367834, "uuid": "8d2ffefa-5827-4733-be7c-2641e1d76f3e", "comment": "Malware payload", "value": "f36c2d312dbf0b29507a2bb49429c47ab7f55d0a905bf63e338fc91111702e94", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367834, "uuid": "446e80fa-3436-4c60-98f8-62428d56955d", "comment": "Malware payload", "value": "af7ab1d8976067563e76f7dc2a550da2336bba1f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367834, "uuid": "9bd39ec1-b7fb-4f8d-85da-6e20962757e7", "comment": "Malware payload", "value": "737b2223d65fca7695835962e165e812d7d03ad43014ee4868bd1c5729730af87573356d168c60a444cc38a895cac538", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367834, "uuid": "90fba4b3-303a-4299-9670-17e71a013c1b", "value": "T1D185F183EFA205E4D1D38C3C527EB513E635380EC7199ABBB38D06503F2675899B9B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367834, "uuid": "7b3292e6-7266-48ce-b699-376ed935889e", "value": "de85a398477c39117ee5fd3f2278b959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367834, "uuid": "5432e715-1561-4c51-a32b-3e1f64027688", "value": "24576:XqzQYLfpzFzgs86dCqGRIiVdLEXXGImzUE/ZJQZlO/TXorZHoL5PE:XqzQYLBys8LvIirAXXmZQZQ/WG5PE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786367834, "uuid": "772d1243-b2e1-4930-80ef-84741968adef", "value": 1739264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786367834, "uuid": "f80a6d51-b2b5-48bf-90fa-b71d380cc3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367834, "uuid": "3ccddf4b-44ce-47ef-a6d3-4249ed8c38c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c889b4-9475-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786336743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336743, "uuid": "d535abec-2c38-47bb-91ab-5f5716f18df1", "comment": "Malware payload", "value": "31bd07ee77651f1b2f23dacffb44b8cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336743, "uuid": "8aebbc82-057b-4180-9c0b-9eb62d6968e3", "comment": "Malware payload", "value": "f36d0079ec6fe87cc39ccb992d4b4a45ae85e854883ea7a2b0106376e14981a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336743, "uuid": "d534c89e-5442-4e8f-b2a5-989fce07aa10", "comment": "Malware payload", "value": "5da8f2ad27d6f7d621adf3135207357185d2901a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336743, "uuid": "efadcd7a-5cf2-4878-badb-7df5906dcdf7", "comment": "Malware payload", "value": "9b754431c3ca01a9e3eb876b4bfbad20ab6fa8d87cfdf2a4d7a70b716dc63d97802fa0e6991b96b9b91b14f4b0a023e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336743, "uuid": "1ad02156-d961-43ce-895e-254539282231", "value": "T121D318177A170D22F4D14135A2FF03E2BFE583CB25784E97B65209C9AF276A0B4932B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336743, "uuid": "9d9ba4a2-7159-403a-a5cb-3a49ff20dfe4", "value": "1536:9j6x/Jw42VCp6gLQppwigoo+Ntwu6+n5p5L1lPG:9j6xBZdYYQpfYWpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786336743, "uuid": "1d8cfbf6-aa7e-42bc-9ca0-aba279523f70", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786336743, "uuid": "1c9b3e61-4aef-42e0-a7ac-695b0d27c89e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336743, "uuid": "39cfa869-8f4c-4c14-a1a1-cc8daf6f3304", "value": "f36d0079ec6fe87cc39ccb992d4b4a45ae85e854883ea7a2b0106376e14981a1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da477e4-9473-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335810, "uuid": "8b0bf00d-4fd7-4fe6-bdca-abf7fb9221d9", "comment": "Malware payload", "value": "492b2f6a8a9330100ba68ef09e69c77b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335810, "uuid": "168db8c6-2e7a-46af-a28b-f7d48166b715", "comment": "Malware payload", "value": "f37060c3b59c1b36b171121effa9e0aebe9b0b16d486c8b2bb9ce535f46bf445", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335810, "uuid": "3a17137b-c30f-45ba-81b7-f8280c8eba2d", "comment": "Malware payload", "value": "99a523c62779699a0557e7fdfa9b20218f9616cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335810, "uuid": "81e199e8-d8aa-477b-a02f-efb31854a0db", "comment": "Malware payload", "value": "9f43f561b6fc0d00c64ce9bf2af83d5ba860dbe8c85c11b43bd7781de81f6c37da0ab91ccc32212704a59a1f947b16f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335810, "uuid": "faafe81d-b485-480a-ac30-1e597eac5aa2", "value": "T1BD231985FA53C1B4E19382B008A7C7E69235DF33505BE6EAEB4D3921FC317018D9666E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335810, "uuid": "f922b81f-1e4f-4b37-8e34-d9cf52567efe", "value": "768:cpQ6L4sqGyldBqRYCoQnGMlAAXLBicEDVRnAkSuSSnTzcF:cq6LvqGylqRoQnuAbyPvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335810, "uuid": "20e73908-2fa8-45ad-b38f-975b07044767", "value": 45864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335810, "uuid": "481852d3-6a60-44d1-b75a-56142c8d66d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335810, "uuid": "f1258dbb-d2e9-4e1f-9cd9-6ae0e58ff0db", "value": "f37060c3b59c1b36b171121effa9e0aebe9b0b16d486c8b2bb9ce535f46bf445.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88234a9e-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373301, "uuid": "0891195f-f0cc-4da9-ac5b-74a3a4127679", "comment": "Malware payload (Formbook)", "value": "2872a5036a6530d001751ac32eecd709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373301, "uuid": "4c3541e5-ab67-404b-b974-465dbb2ec92a", "comment": "Malware payload (Formbook)", "value": "f3cfcbd8c2d33128a836f891791a1743c427f321f538dc208521c371edd03d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373301, "uuid": "1a72091e-3f97-4f3e-b090-ce5ccbff0a55", "comment": "Malware payload (Formbook)", "value": "aff9f64a14f14cad2590e35b6b5800a9ec69f7af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373301, "uuid": "ce847daf-88c5-4203-a4aa-85f304015103", "comment": "Malware payload (Formbook)", "value": "d99780b3543a5613e267e2843b0c328075c33c6b1499329e7f04430b3a5a93de61e25e9401ab8eca0379fb88e9202563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373301, "uuid": "58c70a0c-d71c-43fa-8f1c-3a2eccaa9bdb", "value": "T12A54235C000C9473D4D64771EB9B108FB7A4AAB2CFB385076822E2B5677B5D08EB8727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373301, "uuid": "377499d9-c815-4363-9140-7cc8b0e7d7cb", "value": "6144:8mFbt1h9jV8V70CQ4H063qsQ96osMy2Vmb0LVq/+6LipqULbbK6V0wTLSiFm:tBhPA7I4HvO6ouOmbo6MTfK6V0wyiFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373301, "uuid": "765afda2-7e05-4f02-af11-9a814ad5c6b2", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373301, "uuid": "d2511958-afa4-4783-a01d-74d341de40fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373301, "uuid": "dbee4223-3108-4cbf-9a49-723ccc7c8b65", "value": "f3cfcbd8c2d33128a836f891791a1743c427f321f538dc208521c371edd03d7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd87e31d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373390, "uuid": "675e3aad-2768-4465-ac20-b3c5572f759d", "comment": "Malware payload (PureLogsStealer)", "value": "eb5a864cfab188a7efb29fb05048edd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373390, "uuid": "73c65d67-3457-47a3-b9be-d53c8a4a3d71", "comment": "Malware payload (PureLogsStealer)", "value": "f3d0ff0a74821bf1e79d6e8f17a4d856f71504693d470c12d8c22087a6e3d3e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373390, "uuid": "f135f4b2-a1cf-4fe5-abbc-f5c672342af5", "comment": "Malware payload (PureLogsStealer)", "value": "8947243ff8438461433e39e53e57a3da21ac3b39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373390, "uuid": "a4ad98ab-69b4-4cca-b557-5be7bb99c0c7", "comment": "Malware payload (PureLogsStealer)", "value": "5674684638ffe6939416d3e44163d189b7d527b6bd3c4d5c52d67a229a66d66333eb70baba024938fbba3a3491012b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373390, "uuid": "afe01e80-c23a-4dcd-91ad-3750b174b76c", "value": "T1B77533BB6441C103E88A1AF95371E2706B7AEDC8BD20D259CBE06D977D85B049978F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373390, "uuid": "1e3f3d0c-ff2c-40f0-b1d8-672a43bb6627", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373390, "uuid": "47459354-e9b6-429d-998c-97ac4b6a5ec8", "value": "49152:7aL+w+Lif7cLtQRm/QTP/QqBZZnBeDZjf5R/xKa8a:7aiw+LifIJQsQJbehf5xxKa8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373390, "uuid": "9ca5fbef-9b22-4197-9ddf-6c4d9ad538bf", "value": 1664512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373390, "uuid": "f5d80d68-4b7c-40f3-bfb9-010552eba39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373390, "uuid": "5f50f7e4-a7dd-4aa0-a667-c3750a12f535", "value": "f3d0ff0a74821bf1e79d6e8f17a4d856f71504693d470c12d8c22087a6e3d3e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3e84ea-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370810, "uuid": "2d193a0d-a66f-4aad-b0fc-04304ca85ff5", "comment": "Malware payload (Formbook)", "value": "ce382be6a95b693c198c7ac8984450a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370810, "uuid": "ff3738dd-0a52-4f75-9cf3-2a05a777ec25", "comment": "Malware payload (Formbook)", "value": "f4394f984d6461e7c352cfcf328ddbb97d92d4f6388ed318b2f49c781959cf2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370810, "uuid": "dbd49886-2827-44f8-b481-831155ff61f0", "comment": "Malware payload (Formbook)", "value": "c202693ef1785c126828dc417026be220544359f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370810, "uuid": "954d6547-c22d-4f37-8b97-e12ad076e4f5", "comment": "Malware payload (Formbook)", "value": "985f1741c835372ca19aa693dc865674172d539417aaedc735b20f6f830baecd1d5733d05add14cf8f2bd8ad7f865710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370810, "uuid": "49d07594-d315-4aff-b395-3eea6b7d296e", "value": "T190351249371FED02C8E25FB11D70D3B405B95E94A410E3139AFBBDE7B96F29A6C09181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370810, "uuid": "1b6a486b-bbe2-46f1-8fbd-8c706873c8b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370810, "uuid": "aca98684-6fe7-4353-9cee-e9aa365ee75c", "value": "24576:fXR6pFGQ4cSSd4b9Hc9fFdf/y2/OwV93HveZ7Grpa0:fBi4/m4B89f3f/y2/OcvUspa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370810, "uuid": "5b03ee22-8979-455c-b8eb-60f12365e3e7", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370810, "uuid": "055766ca-34c3-4f84-a9dd-8c62f24226d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370810, "uuid": "d7d3b2ac-49fb-4722-9d8d-e80326a00591", "value": "f4394f984d6461e7c352cfcf328ddbb97d92d4f6388ed318b2f49c781959cf2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6534e650-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369377, "uuid": "be76bd40-37b4-477d-910e-fdd8c75d977e", "comment": "Malware payload (Vidar)", "value": "e61cce2ae0a63af754012a0876191efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369377, "uuid": "71ad36de-d700-4461-a0f9-ab517bfa8151", "comment": "Malware payload (Vidar)", "value": "f44d781beda98a168826c792ebbad02bbef07dce5d5da877a0a59d924cdb1608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369377, "uuid": "69967867-4c12-4fac-add2-2e04763c030b", "comment": "Malware payload (Vidar)", "value": "d67d76db34339cc5b76456f8ba3743d562439daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369377, "uuid": "65d6427c-722f-4cfc-a221-ba7f238d7a0b", "comment": "Malware payload (Vidar)", "value": "dd92c7c68547367c9ab1e8069e4a56e5625d201a8a070807d167f6ae5dea82037cb2a861e8bd8372b08682e2ad004290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369377, "uuid": "ea58988d-e42b-4aff-aae7-3644aefd911a", "value": "T11352E7C7B09391BCC079C3BDCB8906B7D5213499272A6BBFDADC85213BE131069AC695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369377, "uuid": "ded95d1d-4ff4-4a1d-ad34-aa96cc3d9444", "value": "05e6b80baad8cf4ab7984ab97f66f3dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369377, "uuid": "43a5666f-73ba-4057-8a30-0050750aad48", "value": "192:O9VZJ/cCotztlXrNerQYfO2Krjo/pJgGnFlDqWh+W1jhgWogY3V6:O9V3cCoFtlwfO2EcfzFlms+W1ljodl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369377, "uuid": "5abb2474-f569-410a-a827-52c9bf91b887", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369377, "uuid": "a13d064f-d8a2-4479-9278-5b1b6bba3cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369377, "uuid": "2a9c8793-c45b-4042-a90c-4e47755d2da8", "value": "f44d781beda98a168826c792ebbad02bbef07dce5d5da877a0a59d924cdb1608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa94ac1e-94d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786377654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377654, "uuid": "5ba4ef00-1b5e-4fc0-956e-441f168a7112", "comment": "Malware payload", "value": "541a1773592cdd04a702c1cb310b8cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377654, "uuid": "e8eab888-c8eb-4a2c-83d2-37978c320c64", "comment": "Malware payload", "value": "f47dbb997d68ec1253fe7a17280bbf4b1ec35d369f9e59b2eb53ac6c6e267da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377654, "uuid": "f00dfd05-6b01-4eee-94ce-82f723c8261c", "comment": "Malware payload", "value": "950a74074c57f12064d0aeee5802a905bde78b70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377654, "uuid": "0eb9de0c-7fb5-4a63-8064-d262a88fd5c9", "comment": "Malware payload", "value": "04e796fbb0b89982da8bc46a1d6fa0017d3ccb3d184a5c224acb20db9e5fedb37a66817f962ccdeca8b556002079e3cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377654, "uuid": "c59680fb-197c-45fd-8323-a538c9ceaa1d", "value": "T129F29D413F8845C9443CB39A225BA3F9A1424EB7EDA04F4AF27C613D27CEE562133A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377654, "uuid": "e250ad02-ec49-4683-89df-471c183b3a13", "value": "768:TWzPZt6sux8I27llTr7ApVlJwclDiuRkD9yTBazMoBI6:KFt6SIqnHExqklC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786377654, "uuid": "7407d66f-ad36-42a1-a4f9-3601d1df7491", "value": 35255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786377654, "uuid": "02cd56d4-b01d-4d16-bd10-70372834e174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377654, "uuid": "3c4d3800-eacd-4eca-8cfa-5faa0a7b629e", "value": "724826.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604256ef-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327707, "uuid": "b2389df2-8b02-4df1-bba2-706c6b94885f", "comment": "Malware payload (Prometei)", "value": "dcbb75d7701abc0b8264f885895ad0b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327707, "uuid": "6c22843f-8bce-45a3-8e94-56abd08e32ae", "comment": "Malware payload (Prometei)", "value": "f4ac4f735b9ff260a275734d86610dccb8558d1a54c6d6a78a94c33b6aaf6e39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327707, "uuid": "5c893635-74a4-44fe-b407-c5580ce796b3", "comment": "Malware payload (Prometei)", "value": "9c952494cea92443debfb5f1951e3bb7daf9c57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327707, "uuid": "e8e95cc8-e80e-4e96-9753-723402cad5a0", "comment": "Malware payload (Prometei)", "value": "4bedc327312ee0164b005d540445eff1e6ec02596e9ed3357bb4119dbd079a67238962ce9f974b0cc765be1a190398c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327707, "uuid": "5e4501d5-3500-4cad-80e3-ba4ec5bb2bb6", "value": "T148B3F157F5C62D00C3E8AA3DB00FB7B2E045CA3698A980049FAF9F67DB76F1021559C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327707, "uuid": "feab064d-b949-486e-93ef-2b1c4726f7ff", "value": "973785c0920d1d10bba6df76714adc36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327707, "uuid": "1242cff5-05b1-492f-b403-0701bab64424", "value": "1536:daDsof88ljf7UCEGBsklNLA7stO6g9BHHKp5TwvmH7gwT0Nm7mS5ZuX+cguhZxeh:d5ojfYc9dA7HX9kDEmH7gBSvcF9sH1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327707, "uuid": "b94d3448-3909-4c08-87ac-dec50564212b", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327707, "uuid": "552a16e0-f408-4faa-853b-512b7bcb5b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327707, "uuid": "7f484155-2bb4-4a32-a7a4-2e89a81ea34c", "value": "f4ac4f735b9ff260a275734d86610dccb8558d1a54c6d6a78a94c33b6aaf6e39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de894ba-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371056, "uuid": "15f64e15-be96-48e6-b80d-a928ebba096b", "comment": "Malware payload (RemcosRAT)", "value": "a1b49589f198f600b99321173cd0ccb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371056, "uuid": "ab58fe18-4a59-43fe-9a46-c715d83088f9", "comment": "Malware payload (RemcosRAT)", "value": "f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371056, "uuid": "5632d89e-ae6d-4488-85bd-506f4b00ad23", "comment": "Malware payload (RemcosRAT)", "value": "eb202efa4444c09efb7b2aa251d2468bc532ccd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371056, "uuid": "33bea2e9-3b6e-49f2-8c28-d06011c4c24e", "comment": "Malware payload (RemcosRAT)", "value": "66f6ca25d9ca3d68bd2a4f5ef1ca69f36708d30a33566ba5266c332db6fe96a0ea8fe4989bf408c020f1c2821c776947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371056, "uuid": "498f6804-9bd7-4b8a-bf6d-4f224232e835", "value": "T195067D70D351B064D1A7C430CEDA4EF464A1703B52366D1F1BC5E81A25FBE61ABAE3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371056, "uuid": "ae93514d-a84e-4962-a9b6-b0dd1416c485", "value": "e95f383854a3ed92d914fe20659df310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371056, "uuid": "b63d2c26-9cca-47f7-85a5-6015ff5453f1", "value": "49152:j3rhG6uM4q08ykizCL5+zEOOho992tB61HY8SB/Q8DbVCL30IjOqYzUGj4CUrfMy:MbagAD430Ijezzj4xTPnSob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371056, "uuid": "e0d69bdd-482c-4bb0-8026-ffcc85978745", "value": 3965440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371056, "uuid": "f0051738-4b87-4c19-b1ee-a1c4e68d3afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371056, "uuid": "4b3117f9-f95e-4da6-97ee-485ac534721c", "value": "f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1212f8-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372259, "uuid": "24415ef6-69d6-4fcc-9c74-8a410b7b632d", "comment": "Malware payload (Formbook)", "value": "2daf7a402cf6d8dceda42538309626c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372259, "uuid": "7c427d0d-9c9e-4bb3-81eb-786bcccf6e33", "comment": "Malware payload (Formbook)", "value": "f6728fff50c054738c3d6055cf67256251be9b3ad635e4e8855615d4f395d809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372259, "uuid": "9c2f3ee1-00f5-47fb-babc-da1291011b26", "comment": "Malware payload (Formbook)", "value": "4a3e34e7c75d282abbffae4e07ac64f6c01719b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372259, "uuid": "7ae17cd0-4c11-41f6-87b9-3bda4fc7bc3b", "comment": "Malware payload (Formbook)", "value": "22a7878075b088aa2d5b6b6681e21a3c5d92e2a952f9904a94acc27013e9872c25b7ab4db06fb9eaa4e76e6cbd1d23b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372259, "uuid": "398fe566-9736-43d4-a5b5-f48664c84896", "value": "T171352224679EC853C5710BB19DE5F67253B28F88F223C69FABDD6F97B4027A10C85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372259, "uuid": "d543ed74-7bf8-4df0-ab0e-7c20cfb3c9f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372259, "uuid": "a107edd8-b3ec-4d7e-9714-1a952dbe2df1", "value": "24576:ik2WmovchKOL+nlRrmfQVEDaTnbHwsW/Ycg1GQVuIvG:F/cY9lRrhVEDibHle4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372259, "uuid": "ccd8ce08-939a-4d51-8e81-a779dde1475e", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372259, "uuid": "b63db0cc-9a96-4943-8034-a6d81bd0de3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372259, "uuid": "2eb5821c-5f04-43b9-b888-5322330479bb", "value": "f6728fff50c054738c3d6055cf67256251be9b3ad635e4e8855615d4f395d809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c7db42-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786355627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355627, "uuid": "d4490e9b-dc95-4ec1-8c89-6ac6b4b43a44", "comment": "Malware payload (RemcosRAT)", "value": "b0eec6166858cf08cce88f901b4fc5d0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355627, "uuid": "a8eb207a-0215-4929-b2bb-45cee2b1d56b", "comment": "Malware payload (RemcosRAT)", "value": "f685a9a664324c43b0023c426fc3bfaa443e0f02e2cb77e27e22c4b06508ccce", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355627, "uuid": "1d6c708d-335a-4f57-a2b9-19496a8ec8b6", "comment": "Malware payload (RemcosRAT)", "value": "f0f9c6bad5d278a7b9c7c7771469283ae60b3a37", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355627, "uuid": "83e3ddb3-a22e-4989-9598-ca6f2d5f9468", "comment": "Malware payload (RemcosRAT)", "value": "94a350c2cd025617fdda4d9f0de09ea2e5aa3c4ced5a526e5623a07b3544ae12b8faf22e492712ae0a13ed89c5a84b2f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355627, "uuid": "80a91816-777c-43c6-a32b-121aaf4fac30", "value": "T102151202FF418976D68617360BA7B0D6D62DFC27EF26890F2342372ABD766E1C470916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355627, "uuid": "565d5b43-e227-4f3a-9e8e-7430be699c77", "value": "24576:CbLSv9k7eKYt1QRT/64rm1R8wpRSUNkloF:CbL3eKYtmB6TR8wDbNkloF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355627, "uuid": "1b7c9854-dd53-4adb-a2e7-defdfb4a81e5", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355627, "uuid": "3368aaa2-39ac-4537-b41c-1d8b17fb6685", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355627, "uuid": "754ba058-4f83-4f0d-94c0-33498774c662", "value": "Q-062326003_P125L-04SMT-01-HF-2D drawin.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687e2165-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368953, "uuid": "97778099-6b9d-441f-b9e2-6d7d1495a4c1", "comment": "Malware payload", "value": "38a57f3496b5e4c3953547c4645564b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368953, "uuid": "b398be4b-6803-46c0-99d0-43a30d6bcbf8", "comment": "Malware payload", "value": "f69e2e7ae2237841eec6a4a00648bd75f5af36acd49e723f8af83dee2ba2ba3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368953, "uuid": "dee70b3f-bce7-4b26-8a1d-b5983e9f7746", "comment": "Malware payload", "value": "86ab0c151e59b7ed328249180087875bc846dc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368953, "uuid": "3828230c-577d-4485-a858-6aa734e784b1", "comment": "Malware payload", "value": "dd302bcbac3114c89072e58c63018e17f2aaabf1bd5c04f1a3b7b2b162610cbc7a4dd734de14cc350a311cbef1c12e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368953, "uuid": "52575531-abf3-4cc5-a981-e4dc17f6679d", "value": "T1B7D60233B28A653EE06A1B394A76E110543B7E616D124D1ADEF464ACCF3D2703E3F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368953, "uuid": "69580bf4-434a-48ac-9a63-33cd5cad4da9", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368953, "uuid": "38744040-c7c2-466d-857e-93c40c9e5e18", "value": "98304:MoJJqCqegvdED0QnDSwMSj25hvPZqPxx374n:vFqegqDd/I10xL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368953, "uuid": "cb6c6517-39e3-499b-a7de-de4693e36659", "value": 13412230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368953, "uuid": "0552014e-ed5d-4565-8753-1669716fc48d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368953, "uuid": "b708297d-b39f-4b14-907e-9dc46cc6686e", "value": "f69e2e7ae2237841eec6a4a00648bd75f5af36acd49e723f8af83dee2ba2ba3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf01b6c6-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786369125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369125, "uuid": "4371594d-c98b-4138-a77e-ca3479425d29", "comment": "Malware payload (GuLoader)", "value": "7165e27ec641b510a1e556211498d132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369125, "uuid": "947536fc-dc58-4393-bc8f-eb214045f3c9", "comment": "Malware payload (GuLoader)", "value": "f6aa756c8ca14a0a703329bd1d079947b71c77be4ba29d39403daf95c9833c6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369125, "uuid": "6a635aaa-83a3-4a10-ab11-004c98d54c31", "comment": "Malware payload (GuLoader)", "value": "15f64e74a1238a5e4dc69bde5405707e5f5fd96d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369125, "uuid": "82464df7-a64b-4da0-be71-b8c179893082", "comment": "Malware payload (GuLoader)", "value": "37baff6d83218420166b841c3c21693bfbd303966adf326f7ab981840e304d2621d0d0d990e14fe416b21d655a9019c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369125, "uuid": "8265668c-924d-42fc-8363-ef8db3f8d900", "value": "T1FE84CF83F580C6AAFC3D4C71D69762700B72ADB696869F4353D879123BB22C0753B52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369125, "uuid": "719d2e50-c01b-462b-a683-0cd8c87a6c5c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369125, "uuid": "cfb6bd50-4bef-4ad8-8314-e181c7eb8b09", "value": "6144:HmGIhCrl0WKxHId8CIpkIaN3J54fWlqx78Ojq56zf:Gm0Nxodv+JaJrlm78yq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369125, "uuid": "f0a5812b-7990-4a8a-8565-5410d340f693", "value": 390944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369125, "uuid": "215aa211-1d0e-4c30-a1f2-556eb1bd2514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369125, "uuid": "6403407a-8b56-495e-9add-5b7dc77265b0", "value": "f6aa756c8ca14a0a703329bd1d079947b71c77be4ba29d39403daf95c9833c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43147021-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369320, "uuid": "c5b47ef6-1d44-4be5-aa32-ad5fb7c49d60", "comment": "Malware payload (Vidar)", "value": "52da684a718fcecd906dc9528276d215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369320, "uuid": "200ef45c-7d2e-4599-9b6c-7ee38f11873c", "comment": "Malware payload (Vidar)", "value": "f6b76bbab6516df15738b490618c16d323f05dafc14c0db0c86b74d64b665e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369320, "uuid": "a4d8d8e5-9e51-48da-9ff6-167367c1fa51", "comment": "Malware payload (Vidar)", "value": "d81fcfd04dd6f93e26f8872dbbdf2f71837b76e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369320, "uuid": "d0bef20b-f132-485f-adf3-ad9bd85aa76c", "comment": "Malware payload (Vidar)", "value": "3c1a55c13e2bd93dab1fc1c6784275191717216e4dfbe6a7354d8ebd42a2202e60b24f70fd48882598bfcefd8b0ee269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369320, "uuid": "ca75453e-8364-400f-8023-60d0b87a6c3c", "value": "T162822C45E15B52B4C4FBC337536A811366F8BD4122329B3BAFED5A714D52330EA182ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369320, "uuid": "4aa44bde-6386-4105-87a5-5a5e2d2cb9ab", "value": "850ee0121fda1022e1c1de250e3e1e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369320, "uuid": "d70a2bd0-26ee-4b77-98fb-42321a345ebe", "value": "384:OxF50t/XnUqiWg6cHjOVkytQywWBFb1e9/GQCNlO:i0t/pizXyVkyJw4p1G/JC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369320, "uuid": "3d409f52-cb7f-4d02-814d-aaebd7871159", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369320, "uuid": "72cf43ce-ebe0-447b-86a4-8847d52ea7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369320, "uuid": "16c4371a-c465-4a78-8b08-1c365351122f", "value": "f6b76bbab6516df15738b490618c16d323f05dafc14c0db0c86b74d64b665e5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecd70f3-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786370520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370520, "uuid": "e2419b82-060e-499e-aa8c-20663918b4b2", "comment": "Malware payload (RemcosRAT)", "value": "4d474015b199ae7865135c8be7635a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370520, "uuid": "7ce555c2-1a2e-448a-b01e-74ccb844db94", "comment": "Malware payload (RemcosRAT)", "value": "f6bcc2de6becba2ea62a6766184c5003d379fc70c88dfdb53b0c3b184a81ac94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370520, "uuid": "6d983728-b9a2-473f-bf69-3b087e32eb18", "comment": "Malware payload (RemcosRAT)", "value": "5cf36951c895d85040a449d139005184b06861f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370520, "uuid": "9b79dca9-bbc8-464d-8553-ba85a3822cfd", "comment": "Malware payload (RemcosRAT)", "value": "e405888b872153f02977c9a2b17933851f620130fcaa30e6d9077952bb07c42f22f5a76301a63de1c3788259a6e06331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370520, "uuid": "cf635761-f175-4289-92a3-0cc96c782557", "value": "T1C75523D46E0DD811D9C307321A60F37073B8ADC9F924C757AAFDAED7783991BA814982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370520, "uuid": "51efe31a-c2a7-4964-9522-635de13dd7ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370520, "uuid": "319b1749-757b-4fb1-8d70-65b0bf95de0c", "value": "24576:jpJQ8OJHv2LIF8xG25K1G8z5vpb5pyARJ/bwVe5JmH2qFeoKV:jpaHeLr0Y8dvpz5J/bwVeDmHjez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370520, "uuid": "d93d650b-5f99-436c-8618-880cdac19ab7", "value": 1290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370520, "uuid": "7c1fb600-b7da-401c-b33d-cbfa5cbb5334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370520, "uuid": "b22e12c2-2f99-4679-afeb-35e1221bc41d", "value": "f6bcc2de6becba2ea62a6766184c5003d379fc70c88dfdb53b0c3b184a81ac94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054e6f4e-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373511, "uuid": "fb4a7af6-5466-4630-8b66-40bf729c2291", "comment": "Malware payload (PureLogsStealer)", "value": "0bc237deec8b19fcd2c6b782ab0c59a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373511, "uuid": "74ed7bec-6bea-4e58-8015-4d4b0bb8080e", "comment": "Malware payload (PureLogsStealer)", "value": "f72bbcb431e9f5ed7b7778baea18977f91424376be8ead8b88ffe9d561e635e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373511, "uuid": "840174df-6698-4fed-aea7-a76ed621cb2c", "comment": "Malware payload (PureLogsStealer)", "value": "694507e847aee01f104661b69513e6fc40143326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373511, "uuid": "e0d3df01-75f2-4a09-94f0-111eda0b4dc1", "comment": "Malware payload (PureLogsStealer)", "value": "beb3dbbd7e8261847f86dc9da7ea1c73dabe974ce32701e8199c4a254cc8bf683e80873311ec32e1d03e1221f4a439ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373511, "uuid": "d78f6e6b-0283-4e14-831f-96785352ee0b", "value": "T1667512641306E946D4DACBFAB870D33473B84DCF75E2D386AFE56FA738257806914282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373511, "uuid": "63f05ef2-d3d3-47bb-937b-276c5a07f74f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373511, "uuid": "917eab43-e024-452c-b07f-6f415ddeb837", "value": "49152:AxppYrgfVPOMUTbLOBPjQFGvclov1T+pzdrf/CTI:upp9OMeXcU+v1T+dpaTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373511, "uuid": "39071029-9110-44c9-9d73-f47e24ec017e", "value": 1669632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373511, "uuid": "ed5b2a9d-6aa4-469b-97d7-c8c3514b3baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373511, "uuid": "cf849e60-bd72-419e-b516-68bdbe15080c", "value": "f72bbcb431e9f5ed7b7778baea18977f91424376be8ead8b88ffe9d561e635e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f4784a-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786355554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355554, "uuid": "f4d27e30-17f1-4799-9d9c-7d0aaeb31a54", "comment": "Malware payload", "value": "31159be01493eeb09cf3b299702a6369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355554, "uuid": "edd39363-2525-40fb-9e21-4e9800faf8b3", "comment": "Malware payload", "value": "f7a110efa09467da041b7abbd4a0cbbe67e804e78630af22fa8564038576a856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355554, "uuid": "e391bc95-7abc-4045-8a07-ee7982361aa0", "comment": "Malware payload", "value": "1e62f8de7d317ee5d9f32a9fa2aa38eddcda532f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355554, "uuid": "09224665-ac9c-48f5-a9f8-07b508ecf016", "comment": "Malware payload", "value": "4e71a6993f08146517606d7d5d72163510bae554ec9616cb74ff005f31c5e2ba50600c50d90f63e2f1b3629b7744f481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355554, "uuid": "f9f51989-f258-42bd-8c6c-99c5c88bc07f", "value": "T174D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3E3603927B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355554, "uuid": "780b3988-4a0c-4f87-8a15-b09183c5f463", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355554, "uuid": "297a7b3a-e4c6-478d-9eed-e799d8b62fff", "value": "98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5Rxd3I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbn9NI1c6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355554, "uuid": "557801ff-c99e-46ba-87b7-16eba8eec811", "value": 13702473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355554, "uuid": "e4640e2a-a7b8-4c55-bef9-8c9999a24d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355554, "uuid": "fcc37669-eb4f-443f-b8ed-ad7f42d96c4f", "value": "31159be01493eeb09cf3b299702a6369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c14ac54-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371133, "uuid": "5225646c-9cbb-4ea6-8672-592b70c65d91", "comment": "Malware payload (Vidar)", "value": "e3ffbe525c5d6227cfe7e19a4f628c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371133, "uuid": "8959df0c-ba4f-4538-b9df-ec56127f3ecb", "comment": "Malware payload (Vidar)", "value": "f7e43ee433ac9bb04e1af880bead2e4a20b62c246ecc4c0bf505921109a6f5dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371133, "uuid": "37c7ee0b-db51-4138-ab6b-9c800802ed29", "comment": "Malware payload (Vidar)", "value": "e3e5ca3d73d6638e5c9c2d238fddee36fc32b010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371133, "uuid": "b8014398-faf9-435b-8eb8-c93ed010abf3", "comment": "Malware payload (Vidar)", "value": "9e3c6268aa261a1b92162bd05399d2c37f8f75f578d4ac5bdf9a4baae85ed86382f4bda24b8c1b5c1d9e3ea21a846672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371133, "uuid": "35643484-7d7c-447b-a588-985aa14221b1", "value": "T1E152098B70E1B1BAC2A98378C98F17D7DB1530401B2A6EBF4BECC5C436D364161FAA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371133, "uuid": "b6980954-dad3-4b8d-9947-6f0ba83b64c6", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371133, "uuid": "667d21fb-6987-43d6-8f20-253bba0d0c46", "value": "192:NwEfoqctwc9EQ3OB5pGTfstW+sva1HBEY8/vcGW3VwGT9:SEAN9EWTfghEY8/+lwq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371133, "uuid": "fbb720de-0f83-4b76-9dca-8cf17cc371a4", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371133, "uuid": "e72b963e-c092-4ed1-82bb-e140cf83b8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371133, "uuid": "47fddaec-0095-453d-9e28-dbb156bdbd67", "value": "f7e43ee433ac9bb04e1af880bead2e4a20b62c246ecc4c0bf505921109a6f5dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4026dc3f-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368456, "uuid": "646678a7-c4b7-44cc-986d-81e26557af18", "comment": "Malware payload (Formbook)", "value": "9fe4c62b5f265098a425af548000b14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368456, "uuid": "8329b1f4-50f2-4270-bbce-39f3f7bbe043", "comment": "Malware payload (Formbook)", "value": "f860a0c55e24f1df20880314b769079210e9558333d03a5c83cb63dd342bfb44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368456, "uuid": "854f32ec-89c1-479a-b94a-c6d9545448f5", "comment": "Malware payload (Formbook)", "value": "22434ba5792fe01447a8bbc7505ff9582c7f8819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368456, "uuid": "990e5a16-96f2-4c3d-92d1-b87ee5eac673", "comment": "Malware payload (Formbook)", "value": "594399e9ca30eecf46ea6c6911289e6d5a25bfafb28bda09a0145caeac87524092cd251fc827b247bc5c1f61ea57254b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368456, "uuid": "ced7765a-6418-41a8-a3ab-ee31c98283dd", "value": "T1E335F0C43765AB05DD791A34CA39EEB543B92E69F514F89B4ED83F8739B82005E08F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368456, "uuid": "6c732c61-8f29-4056-ac62-5e9793d71148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368456, "uuid": "1df3e184-4dae-4e7e-8972-9facdc764aca", "value": "24576:ZvJUI1yl5mUzTozGXNN9yUd/c+VnqYPpEtuhpK6KG0caUW:Zecu5mUz0z2NvyURVnqYPu+09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368456, "uuid": "38e62469-fde0-4f2e-90db-1e717218754b", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368456, "uuid": "cb9b4128-45a4-4723-810d-a0404160b4f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368456, "uuid": "35c8b880-cdfc-4e96-b8d4-336660c7efa7", "value": "f860a0c55e24f1df20880314b769079210e9558333d03a5c83cb63dd342bfb44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1718a12-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346366, "uuid": "3eff013e-0335-413d-a45d-276e7d03f14a", "comment": "Malware payload", "value": "fa7d891d00a4e9f8822f1e4859abd3cc", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346366, "uuid": "069d9ffe-e66a-40a2-8782-b24dbafc8b9c", "comment": "Malware payload", "value": "f8cb8c7424a598fe8087025bc37cbce336b579d2163d5a4f57e48678499fdd60", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346366, "uuid": "ce045e4f-7135-4ac8-9c29-84f405a8ec02", "comment": "Malware payload", "value": "1d57784001bf9179f6e8f79f06d76d361c51f0dd", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346366, "uuid": "4d465421-ae07-44b7-97e4-b0eb82d316b5", "comment": "Malware payload", "value": "89448c06783463dac1b14f7cbebdd9d05a9a60a25c23432154d239746a18a16ba30d1658912153bd698d7054d56156e3", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346366, "uuid": "3506fb73-17fc-4ac9-ba2e-c8ea918ad8d2", "value": "T1E442089CAA912270F32353CB37AF25BA1224A5D73408C4C4F64D9EE47F4629D4377B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346366, "uuid": "30ac7478-ee75-4771-9f4c-52d2a8bab5a8", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz8Ww8KiDA/Qa:sXX+/DV7k/3ZVKiDAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346366, "uuid": "0e2bc0d6-4237-4f2b-b075-b067a64d5573", "value": 12097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346366, "uuid": "d1927aad-5409-4d99-b29e-a37deba657fc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346366, "uuid": "d8d823b6-1c43-44b7-9c99-983f9420c8ac", "value": "ffffffffffffffffffffqw.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e3b06f-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343331, "uuid": "4636f0c9-e9e2-4db4-821f-5d556a378cb2", "comment": "Malware payload", "value": "2ed0b8f27421ded19c51f64132839232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343331, "uuid": "805ea92e-d65d-4ab9-b61f-3fbb0a3bf4dc", "comment": "Malware payload", "value": "f9134ac017342551c8c3c6f68a721a86e2ee87716ad6c758f7dd6366de3e0796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343331, "uuid": "d42f096d-ca30-4f39-9922-b747c22d5117", "comment": "Malware payload", "value": "8694615828540d0e0f73ed32304d64be82d464e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343331, "uuid": "d7852573-a61c-4665-a491-0449f28f490d", "comment": "Malware payload", "value": "a3f3e5b805187e3d462490c793783db53372c4937137fa8e8824668b02ea93164508bdafb2aab43a201163feab8aafc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343331, "uuid": "736c928e-589e-4082-8e1e-652ab51e3c0c", "value": "T112537131F94267F1CC720A38979A2E196E7709655EEB16611E1F233EED76810CA30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343331, "uuid": "84624856-04e0-4ceb-9019-afcc3670db16", "value": "1536:h/GXK1mWiueGwuuOGuuuuuuuuui4oXuEnsj3hZrLTpgS7CCQAdVf:xOKmWP9loXnMOU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343331, "uuid": "dac6e0a4-9351-432e-9b65-2b4c23c16ab0", "value": 62124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343331, "uuid": "4fcdeb21-680c-42b4-a00a-8a2d9b6f7dc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343331, "uuid": "22b10274-01fc-4b34-8a60-7e3cdd3fd8e7", "value": "main.microblazebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb94cc99-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372179, "uuid": "286206ca-fd3c-40fa-aaa6-b64e44bf5c3d", "comment": "Malware payload (Formbook)", "value": "27002415c43c4ca6329efb2a3d24488d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372179, "uuid": "6b15a8e2-9699-4813-88d8-e07dcfb67f89", "comment": "Malware payload (Formbook)", "value": "f93e3fb83e0b513cd36a595af46b2807b636173b927912dc54260e795af3388f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372179, "uuid": "98ad63b5-1c26-41b6-9f89-1b78f789c421", "comment": "Malware payload (Formbook)", "value": "1bb34b5f483deaee33edca777465f22813139a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372179, "uuid": "61773874-09b8-4a29-94d3-75cd9bd5b378", "comment": "Malware payload (Formbook)", "value": "f7ba6cfe38a9da97ca442561399526919a63958058bcf559c4db004aa8ea16bfac993145ed58949ecb58f46f79b48a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372179, "uuid": "2052ddc4-52cd-47fd-ad3d-e8029ea4572b", "value": "T1473522599A9AC513C6264731C8E2E3F003B19E18F613DA17AEEC7EEB7A337175D12241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372179, "uuid": "db4c7884-4788-4aaf-9b51-5bc649f354bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372179, "uuid": "1bcfea24-3621-4569-be9c-afb6e4c79c11", "value": "24576:GLl6Rf5WmFfVwazahUvugn2E6F+wNKbgWaMbwiSxl+tQh1:3fcoVwuaSvuSpnEWaMpQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372179, "uuid": "c6bf63f0-00d8-4463-adbf-5644d6aae533", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372179, "uuid": "2344ac1f-9708-43b3-8790-9788342bb96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372179, "uuid": "9ba0b04c-b045-4f94-b834-6d50f0142c02", "value": "f93e3fb83e0b513cd36a595af46b2807b636173b927912dc54260e795af3388f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5ec3da-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786347030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347030, "uuid": "cef92fbb-6207-4018-a807-b6a0679f3c46", "comment": "Malware payload", "value": "cc60bcbef40df0cef9d571d81070c5bf", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347030, "uuid": "0a604d3d-2117-4124-bb14-cb4a63c06399", "comment": "Malware payload", "value": "f9909e3cd136666ec71a7bfa18ca0d51ae84fef95705bc9474fdc60b542bbc9d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347030, "uuid": "fceaf447-dbfd-49ae-85bb-d0524266cec9", "comment": "Malware payload", "value": "851472b99819fcdd4dfccaff84899a233e014b90", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347030, "uuid": "ec38abc7-af3c-490d-b187-39e4edbcbd83", "comment": "Malware payload", "value": "9ab2a49efd3de26465aac7f521f6804ec4bf2f88d46b1578c001d4e9d0dfc1824be324c534ed7735390626ae32f22ef9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347030, "uuid": "d860bd96-f2e4-4e12-b216-be268e2baaa2", "value": "T1513207CCAF8063F4F29303D967AF299D132561CB544CDC80F68C6DE06F4B68D4A96E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347030, "uuid": "9d401089-52b7-468c-9c17-9e00f791d573", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzqlX42AiYOpzfMYYVZl9CX:sXX+/DV7k/3qlLAiYOpzEZT9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347030, "uuid": "71d4b46e-6702-4c4c-b681-d80eccdea3e9", "value": 11973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347030, "uuid": "19d04857-771b-4123-b887-765ab70010ea", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347030, "uuid": "9916fe9f-effd-447e-83fc-04d3874d2754", "value": "ttt.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f567de-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373492, "uuid": "b2741f17-dc4e-44dc-80f5-7a65df4506e2", "comment": "Malware payload (Formbook)", "value": "343b1b453af40fd6b6f89b88b8a00b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373492, "uuid": "7d7109a6-fef2-41b5-bd49-e6032504d04d", "comment": "Malware payload (Formbook)", "value": "f9c76fc04dd298b12cbc96f5e9ad7ddd24f5aa8842f466a5747f11894d87b9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373492, "uuid": "c9476506-eb1d-45fa-9edc-86ac28abb936", "comment": "Malware payload (Formbook)", "value": "536c4b23c67456f50170d9aae91107c757618beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373492, "uuid": "d2ca6efd-ceb5-4a2c-aa78-f48f747a8cf7", "comment": "Malware payload (Formbook)", "value": "bd7e24804c17259d1bff561cae24a45399cc96c2f7b83c4e174c43cc5bb0671d6a258d0b94d4fb33214d728e5ee8542e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373492, "uuid": "8decc7dc-96ca-4a49-8c6a-3e8aa053d202", "value": "T1A83501841356DD42E0C69BB2B861E33433B50DCFB8E6D292AFF52FF778197812958681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373492, "uuid": "91e7fb01-d0ef-44ca-85d2-567cd21665aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373492, "uuid": "3aea3754-e205-4997-81bc-38ae572969a5", "value": "24576:mp50w+2ef74uQWc7oSsGK3tiWfka7TZ4DuQe:mp7uQf7oSHKlDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373492, "uuid": "fff5e65c-230f-43a3-8d10-27e6cf951c24", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373492, "uuid": "57d66a81-59a4-4c36-a90a-cd3255734812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373492, "uuid": "00835ac2-3c13-47cf-960b-62d22f7d7b8e", "value": "f9c76fc04dd298b12cbc96f5e9ad7ddd24f5aa8842f466a5747f11894d87b9cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b4eef4-94e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786382717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382717, "uuid": "a65317de-39c8-499f-a746-e6b7b592a0e8", "comment": "Malware payload", "value": "1c753dd3484f01c8365e671aaf3f8016", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382717, "uuid": "5146efb3-dd06-4f49-b0c7-fb28d1f8b93f", "comment": "Malware payload", "value": "fa3c5fffbecc3772cfa8ec10e023e480813d2b9e86f3431179d0f86646d736b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382717, "uuid": "116096e5-0877-4b27-b23f-1c3e4a284a3a", "comment": "Malware payload", "value": "32d170f268d498fb64fe9c41c8145c4cea2f3757", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382717, "uuid": "85208ffc-9de6-4a8d-a5c6-20d3b8af5618", "comment": "Malware payload", "value": "03a1b8b04c08bd0e1a9d82c2eaade42ddfcc83850c39d0d2c3d06fdca004d38f50006ff242d1b04e6c0e884435e99f2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382717, "uuid": "f853bebc-07e6-4baf-a9ab-f5fe5a8c4877", "value": "T14031A2AA04105E314283CE8E73B3704DB24DA5FB299FDBD499990DF942486DCF2A1B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382717, "uuid": "3c5520fd-d60c-4a7f-84eb-61ee85d08690", "value": "24:+0O0fD1L/zf5KsX4DVqRM82Zu8g7zk3Seue5V/x9:+0O0fJL7xP4DVqRF8fSeueb/x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786382717, "uuid": "acf9a264-a1d5-4286-8e93-204c35bf78ee", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786382717, "uuid": "bfd97f9b-fc8e-4978-9d52-84df5d8d8eff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382717, "uuid": "9616e8c0-58a9-4748-b75a-050002b29de7", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4efafd-9496-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786350999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350999, "uuid": "1952d15a-f1da-42e4-b790-77867371f643", "comment": "Malware payload (Formbook)", "value": "29ddf55f03f28dfa8fe5ee7e85808cfe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350999, "uuid": "63eddfeb-569e-48bb-82d4-1069e16c76d4", "comment": "Malware payload (Formbook)", "value": "fa56afa9f3c00f4f6db909560c6df8c23c25b314545369c2dcb8e83c8f87d970", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350999, "uuid": "5b895c51-1f55-4d46-9c36-7b30e82fa998", "comment": "Malware payload (Formbook)", "value": "0b73fbb38430669669eacf3e0c99613ebd30ea6d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350999, "uuid": "4400cc2f-6b2b-4ebc-86c1-ed420387ae50", "comment": "Malware payload (Formbook)", "value": "8a9cfe2d330b58e10580e40b022657a22148256b4e5753765804c28a76673c4fea59f183c5490393fd0a18628cac7f23", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350999, "uuid": "8bb92db5-1f40-4d81-9298-55214eacc920", "value": "T1FB56FAA73ADE758AAA09328E5C1EDD040B8EC0246DA79DC864DD1D8CB80F5D525C4FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350999, "uuid": "b3175e03-8c37-420f-bde2-907f9e67a484", "value": "24576:i6S80pLseQwdXAID/GF36S80pLseQwdXAID/GFP:ikI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350999, "uuid": "c9adfacf-0f3f-4868-9d0d-2aa8cd5c7792", "value": 6136092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350999, "uuid": "1e3b1232-2991-4c6e-96fe-76b605935a75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350999, "uuid": "0b0582fe-d543-47b3-a84d-77beead79487", "value": "MV_TORONEOS_FULL_VESSEL_INFORMATIONpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b594c5-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348247, "uuid": "503ecd90-e8b3-422a-8892-d394dbe0855a", "comment": "Malware payload", "value": "98553239ccc70f2f1219554989c0bdbb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348247, "uuid": "59f6571b-0051-413e-928f-576783037718", "comment": "Malware payload", "value": "fb2e723cfd4e6fdc7e04214405e4e5d474eed5f60c5e88f4940217a0b8c7ba37", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348247, "uuid": "b92244d9-faa3-4a2a-be73-7c20f95dadc5", "comment": "Malware payload", "value": "315a48812aae3045db53a5520217b6903bb49cea", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348247, "uuid": "678a427e-fca4-4f7b-9017-4c59c1f929ff", "comment": "Malware payload", "value": "c46c85cb784858d904329a80eb13c7f69a5e160ca13df75dfe0cab1df62da7a70ff9bb79a76b62348bd7cec68608071b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348247, "uuid": "79a9d7e6-88a3-477e-9cfa-8a16f80dcb7c", "value": "T1E042E68CAF9073B4F29703CD37AF2999136561CB504CD880F68C5DE06F4B78D4A96E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348247, "uuid": "eeb56623-146a-4728-a34d-ee79bb9f17a2", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfM+Jdl9CX:sXX+/DV7k/3/lLAiYOpzEQ9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348247, "uuid": "422e331d-bb01-424f-8c0a-cc74a4ffe10d", "value": 12009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348247, "uuid": "781d398d-42a6-4cba-a530-0ebd9f8fdb50", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348247, "uuid": "3f25e0f2-b913-4d00-8512-bc505d5eb06d", "value": "don12089.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99be153f-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371183, "uuid": "0e615cca-704d-4db1-9e64-134a75a0d16d", "comment": "Malware payload (Vidar)", "value": "f180cd9663227cfed610894f1ed7c240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371183, "uuid": "531b4552-f323-4bf4-9048-d54ea8466538", "comment": "Malware payload (Vidar)", "value": "fbc334750239958788d5f4f2f87f79bf4e9181867a009aa525c7f7fbe7782a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371183, "uuid": "eb712369-93f0-4bde-96f6-c0ed02c52b9a", "comment": "Malware payload (Vidar)", "value": "1f4641afd04974a98ed938e40c513b96582d8b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371183, "uuid": "4a4bcf76-7b50-4213-bde4-884fdc35221d", "comment": "Malware payload (Vidar)", "value": "51b30eda3d8aa1ca2b645f9da41e473b91237a05dc96b734a75431c532cb6bd2f94b37e129b95e42db604a46655b7ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371183, "uuid": "8bc25d65-baf9-4b97-ae62-ff6fc1649a94", "value": "T19552F7DAF197E1BCC1A9C77DCF9A02729666348803221FBF5AED45503A83721B27CA54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371183, "uuid": "16cbd1b0-7384-41f9-855d-5f39a931b63c", "value": "e23bb1c08602479266491150dc857434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371183, "uuid": "ea11f5ef-b7ae-42fb-a99a-c2ca8da6f172", "value": "192:O2qk8YI/cMFQaJpAxv58hwbFOXJF7ll1ZV++Df0W1QkkNbiM73V:ObYKbJaR8oFO3Jd8+z0OQklM7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371183, "uuid": "d39cf384-cc9e-4b6f-893e-7d54dceb2d4a", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371183, "uuid": "d1e7d0c6-084d-430d-a2e6-de17cf6a24b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371183, "uuid": "9c502ff8-7418-4be3-a215-4c0888c4bcd0", "value": "fbc334750239958788d5f4f2f87f79bf4e9181867a009aa525c7f7fbe7782a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81171964-9486-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786344083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344083, "uuid": "3c39e7b2-a885-406f-87cf-f561db343ebb", "comment": "Malware payload", "value": "558cf53d8679839d56dea4f6aaf2d316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344083, "uuid": "6dad8f13-6542-405f-9f80-b34efabed675", "comment": "Malware payload", "value": "fc28c85c4e7bde1ce9c41a865681fc43cf897048c4e8ff371802e386bc29ab37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344083, "uuid": "f8499c65-5a5d-47f6-871b-8c06a668020c", "comment": "Malware payload", "value": "0103bfe6be925c4ea4cd911e0c75bf2447cefbec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344083, "uuid": "67e0ad19-b64a-4236-b61e-abc6a59f8a34", "comment": "Malware payload", "value": "d5f9fdcbd85daea2bc6e3ed8139407b698c748da703c59d9ff46eb20a24315ff5dc2565d2e20ef9a0025405cc52ff65e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344083, "uuid": "309e0f59-eb80-42f5-9b3f-85d16a1811b1", "value": "T129132A428D218324C6E512FC67F54A59E3C15E0339DB2701CA72FB397DAE0A4AA53DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344083, "uuid": "ca557c89-b674-4369-bbeb-320ac627e5c9", "value": "768:h/YYHp1GcO/TIKcVyAEjO+XLrU0G3pQgByuuIqkoge/V:hpzqTWmzE0GCgBjoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344083, "uuid": "14e3ee07-323e-42b3-8011-5b8c4ca75d5c", "value": 42216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344083, "uuid": "1ed3481a-830d-452e-8201-926c32210635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344083, "uuid": "83970fe0-4e48-4414-9440-9ff76824c126", "value": "main.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d6cd94-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372173, "uuid": "3b451b07-ac42-4df8-ba72-85a90f2e5d89", "comment": "Malware payload (RemcosRAT)", "value": "565439f3d24b3bc33e1f4ffc1e499fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372173, "uuid": "0ef2b544-7826-4f66-b7b6-0ed5e2c62b1a", "comment": "Malware payload (RemcosRAT)", "value": "fc48b40be3b232ad4cdd5630d857cfe50415fe05b6677f74510cb6af109328c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372173, "uuid": "090029ee-6d68-4363-9ddc-7be3cf839b63", "comment": "Malware payload (RemcosRAT)", "value": "61add0884b9ae87d19c0e7d270f8681c9644496c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372173, "uuid": "01b443a3-5399-42b1-843e-88428d54ce58", "comment": "Malware payload (RemcosRAT)", "value": "e426c799f09d8cdb5b3a014179ad2c417b20c59cc0d54009be80d6da28cd6db859ae6a83cbf2b4704dbb53e34a78c989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372173, "uuid": "0ad2e694-1f90-492a-abb8-8e89355d0f89", "value": "T1AD15121047AFC117CAA4573299E1E2722371CED8F123E66FABD9BEDB7A223655C11301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372173, "uuid": "7305ed99-e88b-4649-9eb9-1c848058d1a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372173, "uuid": "ad93d2b5-9eac-4419-9fcc-29462f1f2f17", "value": "24576:UJDW2Wmb4HwVpPq1OBnsOSwsme5NMv4MYvs0f9:tpYuOqguav4MYLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372173, "uuid": "eaf0a502-a45a-4050-98a7-42c941873c50", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372173, "uuid": "bbfcc115-c941-41ab-b17a-3896e6c4c0af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372173, "uuid": "007e917e-c242-4f70-9b14-e3591ecbfc18", "value": "fc48b40be3b232ad4cdd5630d857cfe50415fe05b6677f74510cb6af109328c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f1739f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369190, "uuid": "beffa458-dea3-4b6d-9c9d-b0ea2e05492b", "comment": "Malware payload (Formbook)", "value": "76e3d005de0b770e0879a7a535657752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369190, "uuid": "2ed93b75-d857-45a7-b5dc-176ffd10fc2d", "comment": "Malware payload (Formbook)", "value": "fca4f9ad11c8fff944281863838c11781116f46af3275adbc9ea0bd93d0a0721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369190, "uuid": "b6ce2e0a-ca48-48a7-b89a-533a2535b964", "comment": "Malware payload (Formbook)", "value": "8424296a56bcc162cc98d6abdc49533560ecf067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369190, "uuid": "f443be5b-d57d-4031-8b3e-15332132defb", "comment": "Malware payload (Formbook)", "value": "db80c368f8d43d459478cc6d80618fb7a6ebc921bd61e8727d9636d515caf22f084e97bbcb7a89a1964dd94b77724295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369190, "uuid": "8dc7d2d6-12aa-452e-8fc9-8f29681e48a8", "value": "T12C35120423E9DD05C0B65BB02EB1D27053F82D99F962E35B9FE5BCEB78797110928392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369190, "uuid": "b5a84471-4797-4efb-80df-0d2e972856f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369190, "uuid": "2d00dfff-08f4-4204-9a51-1d459cfd1d5d", "value": "24576:cKZkYeJaRB4hxapVDASwHvsJjpbLaGZhx78STjmpGHy9HM7D6:vZggCv2VDASqwjpbLaGLBHfm2uH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369190, "uuid": "1fc18706-50a7-493f-bcc4-4a6494f0d534", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369190, "uuid": "be0e3605-ef14-4909-aae8-e30872af3dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369190, "uuid": "b23ce830-7f87-419f-8aa2-14f7526e87c5", "value": "fca4f9ad11c8fff944281863838c11781116f46af3275adbc9ea0bd93d0a0721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30fd55c-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339926, "uuid": "b48e471d-9dd8-4c37-b204-14ef4124faed", "comment": "Malware payload (Mirai)", "value": "2abc322a08c204405bebfc173db5076e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339926, "uuid": "67a82517-1193-4084-a1c4-a7b5070aca54", "comment": "Malware payload (Mirai)", "value": "fcf212cf6e53b7d3a42f42ab4e162fe42ff886836b39952e308a022e87a29cd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339926, "uuid": "dace78a3-1eb8-45f3-8327-c7b4b2c1aa90", "comment": "Malware payload (Mirai)", "value": "4550dfaebd267f2b4116c6e29837c15324e5aa69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339926, "uuid": "1636e399-796d-4134-a7c7-ad7ea3465de5", "comment": "Malware payload (Mirai)", "value": "6375818e3685bd4ceaaa0ce08bc0f746412a2faa57f97c15f6cea57c091b9d3511c21caa53c23f9cbda8ddc519c3153f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339926, "uuid": "6886bb32-4ce1-45f6-9b45-9a0102215bde", "value": "T15F94294863F0D3DED1A9ED70233A7F1A9BA6062630977546211FFA6313B21B10AD9DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339926, "uuid": "121beeae-6006-4c16-991d-00132b5618bf", "value": "6144:p2m4BIXCO29PELElyCybEDJKi0r/pW2CYmXdQEiQ:p2m4GXIc4lyCfDJKi0rhzCYUQEiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339926, "uuid": "0f9fbce8-0940-422d-9aae-7077219c5672", "value": 410384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339926, "uuid": "0a2addd6-8e81-49fb-af76-fed446ef3e37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339926, "uuid": "a94e26f7-c15d-45f6-808e-71817f76f972", "value": "pid.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b31b56-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786372651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372651, "uuid": "79a49e0e-a5b4-48a6-9209-b4b7048938b2", "comment": "Malware payload (Prometei)", "value": "8cdeda45cf2f979abffcaa11aeb1f6dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372651, "uuid": "0953da57-842d-4465-b029-cf99bf1189d0", "comment": "Malware payload (Prometei)", "value": "fd2b448374a77e200bef50c4118b960c48d4a94a63c96968df63b0fcd3f83662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372651, "uuid": "512979d5-6fad-4bf8-8706-05cb1d99b8e6", "comment": "Malware payload (Prometei)", "value": "eaa47846a838fc3b00325470f54183eb6e972974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372651, "uuid": "6b1cc278-4e00-40f7-8aab-6794e8a548bc", "comment": "Malware payload (Prometei)", "value": "ff2ab66d40307f63913e7a2119f316a03f994b82123865e6bca98e4ee877cbea6f4036b23b5c5d016b8a54eb847c4677", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372651, "uuid": "324f1a84-7bb7-4bef-80c4-7cba59a0612b", "value": "T1A6A423F4F9229E9F6DD769B91B24C31DE181C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372651, "uuid": "b6301c57-1e8f-4d3b-87ec-4a7754133495", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdH:Fs6pyCC/Ya2hpi6T6N4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372651, "uuid": "28f2ff69-a412-4f0c-a91f-ca91bf9aae0e", "value": 449084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372651, "uuid": "49755f6f-556e-4944-8c9f-f9dc09acdd3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372651, "uuid": "6a7d6b9e-167a-417f-b7a2-6102b248f2d2", "value": "fd2b448374a77e200bef50c4118b960c48d4a94a63c96968df63b0fcd3f83662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bec66b-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372252, "uuid": "6e2de6f4-9731-4c5a-a4ee-356e36fb2d87", "comment": "Malware payload", "value": "e561c8d4fa2a4106a51face46753ef3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372252, "uuid": "fe7c36ba-d103-4db9-b792-48c98620c3d1", "comment": "Malware payload", "value": "fd30b4058cb450da05ae855ed9dca0f229403173018d3958a45370f3f3bf9d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372252, "uuid": "2e4c912a-78ef-4f72-936e-00ffe35b214a", "comment": "Malware payload", "value": "16e4db2e28eeef5a590d79c203a660624bf0c818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372252, "uuid": "82e4da64-bbeb-48a5-8039-693f5e44d52a", "comment": "Malware payload", "value": "fcafdd57349e39f8c29bc01843f6ec82a4a43e68ad0204bd8a29c54fa4c0ee1a98340612667c30794b3687d44078afdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372252, "uuid": "0abcb0c8-7e8a-4301-9f5b-dc1dafe2ca14", "value": "T1B7D4231033E5583BD79702702ABA5B326D9B7DE61DAC1B074B507E6CFDB1A51F808683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372252, "uuid": "22ff3846-f24f-4c4e-91ea-f173dba7f6a7", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372252, "uuid": "bd7bd1bb-f8f4-4c8d-82c3-5e9338d77d1b", "value": "12288:yX42dx02/7PEhE4JEsr3i8voO3t0JKAnQ17yBGnvFCJ:s42dx02/TEhEJ8joO25nQsw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372252, "uuid": "1a4a865e-49c7-4352-ba43-6b46ece3a9b7", "value": 652152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372252, "uuid": "fd31e00a-24de-4d03-8e47-d3a6e22457a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372252, "uuid": "62c7e33b-4b17-4209-be47-2679ff51ba42", "value": "fd30b4058cb450da05ae855ed9dca0f229403173018d3958a45370f3f3bf9d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5968ba-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786371806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371806, "uuid": "9bb27b8c-f083-4bc5-9e28-72c328e5ff78", "comment": "Malware payload (GuLoader)", "value": "7a954b328cd56375afc04859206ab499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371806, "uuid": "caae10d2-4196-4091-bcf9-400aca795ea5", "comment": "Malware payload (GuLoader)", "value": "fd30c8f25d9b5c18dd9776a685326190df6ffc6339d29f3aa689f1a688751078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371806, "uuid": "cf5bde61-2666-4fed-9905-846539ec34c7", "comment": "Malware payload (GuLoader)", "value": "8ea2db532f67f0c00463edd95ded6563ea682f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371806, "uuid": "dac36ca2-45bc-478b-841f-af6c6c996486", "comment": "Malware payload (GuLoader)", "value": "4f929e2596c0a2ff8bec71d55972e08a67ce65b3795ee74895a2195636d0cee6e7fdea9c04f2f549b277dacab36cf1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371806, "uuid": "d8ee79ec-c1cb-4d13-a12a-b6925a95d7d8", "value": "T1FC7402407791C6B7D8290A309E2BC2A60FB1BDA60AE55B9B3714771E6C33387890F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371806, "uuid": "920b6457-ce14-4d6e-922c-90af0560eef0", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371806, "uuid": "fb92582a-f304-4ab0-b811-f0f9c17ab950", "value": "6144:OHadpdwMGEzAiBLY2mRgHofdxNZFqk+/WmURKI9raD8r9:OHaduEzAiBs2m9HZqKmURKI9eD+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371806, "uuid": "24f8c2b4-eae1-454d-a6bc-12bfc344e35a", "value": 337728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371806, "uuid": "ed0444b3-c4b7-4758-9724-64a091c98018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371806, "uuid": "5e1980cd-41ef-4cb9-8110-2016f57e6206", "value": "fd30c8f25d9b5c18dd9776a685326190df6ffc6339d29f3aa689f1a688751078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6b7571-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786357019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357019, "uuid": "d302376e-c14b-48e0-86c5-29c4aef14d25", "comment": "Malware payload (ConnectWise)", "value": "f466e3112ffdfa965f4457c98dee5b92", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357019, "uuid": "c17f1d53-2f01-4ad8-b08b-323acc2218f0", "comment": "Malware payload (ConnectWise)", "value": "fd7cee5a13218f6d00b40e85579c6f4b4f06d5432b9fb785b0b81f8547c197f4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357019, "uuid": "1e6c2fab-4e97-4c7d-b9a9-658407164526", "comment": "Malware payload (ConnectWise)", "value": "55f6b5e510fe2149eb713cce3aa68ec07d313c12", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357019, "uuid": "d02305b4-dc28-4cc6-9bb8-5621f6391cde", "comment": "Malware payload (ConnectWise)", "value": "00eda20bb8a87d8fa35b618f2d6374f42b89a0ebcf3e25f81f4b891da5a723497cfaffcaf856575309e34ea850db4ffd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357019, "uuid": "6244b64a-9adc-44d7-868d-b9da1c876830", "value": "T10E646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357019, "uuid": "1be6ff83-f67e-4135-8adc-a5d3aa80fef6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357019, "uuid": "22e8a610-2fbc-4ab5-9ad1-39319ee8240b", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357019, "uuid": "b24a36d4-c4bd-40fc-9d21-8f58aee48ee9", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357019, "uuid": "31e5d609-1b16-42a4-9fea-f0dec24720c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357019, "uuid": "312a0c3e-2ad5-4a54-941e-6f179f5b0ff2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9e4d18-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369602, "uuid": "fc8a3bda-a34b-49f1-abb5-c18a5c64751b", "comment": "Malware payload (Formbook)", "value": "02a72eef288944158cd11fd78ed562ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369602, "uuid": "bf3c4b47-2df1-4da5-a26b-687de779c06f", "comment": "Malware payload (Formbook)", "value": "fda2bc8a180031042c83ea3fd43ff1c23a314ae11b4e6878708f595eadd7201b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369602, "uuid": "715885a6-a105-4208-a67a-3864fc87b08a", "comment": "Malware payload (Formbook)", "value": "b9546028772fbb05cf236ad0885af99e3e555b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369602, "uuid": "9fe42bef-8f3c-4181-816b-cbe4d1527664", "comment": "Malware payload (Formbook)", "value": "067dd2cd131a68bf181c888a8c8ecad914a052de2c9f118ecb050624182ff16b856e2213675d36ab1f92ec438c48f6f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369602, "uuid": "980c284e-c690-463a-8ee1-2af45c0623a2", "value": "T156350205679CCD03C86A137868B4F2780B795E59F912E3035ED8BDEB79BB7228C15287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369602, "uuid": "29af70bc-5cc6-441d-b9af-f6cd72f78579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369602, "uuid": "cbf352b7-6a39-43d9-b905-a2b230431140", "value": "24576:sA9vV0Ln1YIClQjzwfqkk2XaVAl4aOri1h7jUtP+:sA9N0Ln1Ls6jmaVAGi1djmP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369602, "uuid": "19c690e4-9f65-4532-bd32-bc0edac2f8b0", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369602, "uuid": "5177fa70-3b73-4240-ad95-6c2b717f1230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369602, "uuid": "d373fda7-1d3e-4ceb-b221-9de1cc656e7e", "value": "fda2bc8a180031042c83ea3fd43ff1c23a314ae11b4e6878708f595eadd7201b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d683d452-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369137, "uuid": "b5e22fff-ec1a-4ee5-a9f3-dd81b1849f17", "comment": "Malware payload (Vidar)", "value": "e038a1021603d21a58f753c9de3b2038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369137, "uuid": "ed9695d2-957f-4ba7-a5a1-7e70bfa9c77e", "comment": "Malware payload (Vidar)", "value": "fe590bbb6aef56a5be3656bcb7d3d4cd26eb145bee586f9ef02199f7bb1676f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369137, "uuid": "46a2611c-bd94-486d-b219-107db37fa53f", "comment": "Malware payload (Vidar)", "value": "144903e2b9145947db238cc94671735ac9ffa3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369137, "uuid": "0c83addf-8569-41bb-b8f3-37ccf30c9731", "comment": "Malware payload (Vidar)", "value": "f103f735a1ee4239d1265418e14a95d04db7a6432db4d94e0c8901cc2a30793edea3a7e491732546451fd71a3105ae10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369137, "uuid": "6ae0d5c9-9f5c-4b3e-b9e7-87bcd739f0ff", "value": "T1CC829645E11799F4C4D6C33693AA02A355F87C1122369B3B6BECB63A1D52330E7542EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369137, "uuid": "ad2b1d01-798f-4a28-a03a-30c3395faae0", "value": "11947076675cd2ccb7ede65c6ece700d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369137, "uuid": "00d6ee9f-e033-4505-a2e5-32c543f0dd12", "value": "384:OYfIQpys9mrzzumpXdHQeAAJU9tjLwIZ1E1lYt:HtenwePcwILAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369137, "uuid": "d203eb83-b8ce-4bdd-9413-095d8981ab75", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369137, "uuid": "5e48de4b-1fd1-4366-880e-055962151d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369137, "uuid": "3d906ce8-9ba4-441a-9753-7f4587e7e5c9", "value": "fe590bbb6aef56a5be3656bcb7d3d4cd26eb145bee586f9ef02199f7bb1676f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df019c01-94db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786380748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380748, "uuid": "2c98bb3a-19ba-4186-8303-d1c08053e565", "comment": "Malware payload (Efimer)", "value": "d426de7672d8187fc17473a136a58b2f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380748, "uuid": "70c5e573-737c-4559-8f51-4f1b17b9c7d7", "comment": "Malware payload (Efimer)", "value": "fec21c04c7c993f6d5379bb6b45c5eff1869bca0ccbb4e8735c83023b6793e41", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380748, "uuid": "2c592574-9a41-4fa4-9a4f-3b0359ba9ec3", "comment": "Malware payload (Efimer)", "value": "91b0265d8ea80a4d53d0b5efe629d8f09e941ab9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380748, "uuid": "3ec4501f-e3a5-4afc-b3ca-1357177462a7", "comment": "Malware payload (Efimer)", "value": "b2c5007dc21f5120620e5a34f08068c229a97dc798642f5ba56e4e1c55d498fcba1c16a818710f3b0f8e46f1a6b6be9f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380748, "uuid": "4691c086-f86b-4141-94d3-ba26aa7af85f", "value": "T13FE6331C79D0018FF823123EFD922161A6A5B8725771CA9B8BFC82767E172F0593E617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380748, "uuid": "f1d779cb-4c5e-4e9e-bba6-76ac2a499f69", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380748, "uuid": "410a18d8-6414-4c43-b328-439a8c351855", "value": "393216:O8Q2NSVIJvGOVW9gXMCHWUjCcuI3/PGTAI:O8Q2NoIGOVW9gXMb8/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786380748, "uuid": "a8bab4df-db2c-4e64-afba-7920fc0617ea", "value": 14064287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786380748, "uuid": "ce26eb2e-10d4-457d-af49-2cfd735c2d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380748, "uuid": "796f515c-659a-4f20-a85b-22cd13aa41a6", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde61c37-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786372962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372962, "uuid": "645de7a9-8d6b-46c4-b02a-255ec2b2aa20", "comment": "Malware payload (a310Logger)", "value": "56c390819d564f04ff5bb5d9d1713790", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372962, "uuid": "0d2629e1-745a-4f10-814a-ab445cffa36d", "comment": "Malware payload (a310Logger)", "value": "ff0dc35248d08a47e19a5489f65d4aa317ea1d716c3dec0a47478bd216bd3fa3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372962, "uuid": "64ad7a4d-421b-4ca8-9db3-aea0afb1bd5e", "comment": "Malware payload (a310Logger)", "value": "435da6f2c0f5ee008379fe92971e9babe52e89e3", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372962, "uuid": "0f07a8a0-38e6-4ace-9198-74e3bfa68289", "comment": "Malware payload (a310Logger)", "value": "95ad958c230465c3b195f22b01514381180e053344e92b9b152ad6c980c4a55962c3b44d157766db86965855a9481bf7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372962, "uuid": "e3a8ac82-9c0b-4d67-b38b-bbac72cb4f1f", "value": "T158944A13EB60A11EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372962, "uuid": "4198a858-aff8-454f-8265-085fd4647c29", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372962, "uuid": "e41ae639-e880-4727-b7c7-66a1d3189e06", "value": "6144:QP8d1/w5KA81IJ8GpF6nuTmOOUiBUrjDta4gezA+vBAAwTqCwWFoZKuz7yrQmvds:QEjYKkJj6GmZUiqrBzCg77yrQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372962, "uuid": "b6bfc6c1-64be-4156-b480-adc2e75e63a5", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372962, "uuid": "55aa67d3-e1af-43dd-81e9-5fe6db815c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372962, "uuid": "9449c9c4-1b42-42b5-853e-900bea37f9ea", "value": "ff0dc35248d08a47e19a5489f65d4aa317ea1d716c3dec0a47478bd216bd3fa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a0218d-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "30569d64-43b6-4e16-a6fb-a91b083ab11a", "comment": "Malware payload (Mirai)", "value": "7c8c60db63c075743c20b2308c5605d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "931dfa94-d460-4a8c-93a5-87bd50dd4a19", "comment": "Malware payload (Mirai)", "value": "ff4d54d5368f07b42ba40fc52051a9a14c81407406717eb9188fef7a343ebc66", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "43f9cd42-60d3-4924-a80b-10f317e91496", "comment": "Malware payload (Mirai)", "value": "099f81915c8c70cd81721b0a4240e68139f739a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356838, "uuid": "3c9fecfe-0490-4130-87f3-0c6c11dc1344", "comment": "Malware payload (Mirai)", "value": "97add1eaf4543fe95a6b06128e3b00d6e35b0d89fefd0ef717b6c1427ab9bb71f4971ff1cff37fdea8ffa9470c97f9fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356838, "uuid": "fbee11d0-1641-4379-ac73-f732fee6b33c", "value": "T195443A86EA818F13C0D617B9BAAF424533339764D3EB73069A14AFB43B8775E4F26501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356838, "uuid": "d0c3d6e7-1c15-41b4-b565-f44dabecc659", "value": "6144:1YgHE2vChQH1Ao1RIo9aOSAE+uF7bUomSuuW6RS/zn3M/RgztGmn02v0PbUyM:agHE26hJeIo9aOQ+uF7bsSu8Rqn8/uGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356838, "uuid": "2373d643-4bd6-4ce2-b2b5-287c73803086", "value": 270523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356838, "uuid": "2e4095d8-c54c-4bd8-8b7f-56009a558286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356838, "uuid": "eef238d5-a80f-4c27-b2e8-60674e9ad473", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d561f66e-9486-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786344225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344225, "uuid": "5f82756c-8b21-4a83-9285-7416b0a1df09", "comment": "Malware payload", "value": "e6b9028ad752a9e2cb6e44c88dc41516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344225, "uuid": "859e0538-0d19-4658-bf8f-365fd8b57132", "comment": "Malware payload", "value": "ff57a9630c8dc3c31e1b5cd2e22fbc4150cdfeab913ec5018e7bd7f3dcd93628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344225, "uuid": "4a782391-a645-490a-b6bc-0550edcb084e", "comment": "Malware payload", "value": "08d55d4237e3d5fcf6170dad34d390cc686c6323", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344225, "uuid": "bc3183b2-1374-48ce-b518-4e6843ba9661", "comment": "Malware payload", "value": "7695a993840d019ebe29410fc07c94cc025b9c7099c0849f2cbbf2256e3dc95401d09d13ff002deba2c61e34cd3dc1ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344225, "uuid": "6b2e615a-aef9-4212-a7ed-cd9b00bee892", "value": "T183435416AB679D77C80FDD7305E8860124CCB49762A93B2B7270CA6CF75A88F05D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344225, "uuid": "82f7ce6d-84df-48b1-aa45-cebca7f509c4", "value": "1536:2W0IzFS9shCASafdooRHUD8eMLSolpS+KzQZqSg4JiAUIaJh:2BIzFkshCAS2pRUDVz7Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344225, "uuid": "12d2a269-7bbb-46d7-b97b-9bdd3381b1b4", "value": 59704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344225, "uuid": "93869158-d640-4d79-ad6e-a5319c4ca25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344225, "uuid": "e3ec5251-4cf2-47d4-b670-5343dfc78e1b", "value": "main.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5446fdbc-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368919, "uuid": "a1141296-4ce7-47ea-b31f-df31f6735866", "comment": "Malware payload (Formbook)", "value": "d309cbb08c834180089bbae81780a0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368919, "uuid": "fb1114b2-0a18-4228-a9c4-8182d22e40b9", "comment": "Malware payload (Formbook)", "value": "ff7f4f7367fedabb89215428edb505fb2748248e623fff7fcc90dbee745aa083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368919, "uuid": "128e2c26-e82b-4369-a58b-477491145093", "comment": "Malware payload (Formbook)", "value": "0e9d79294f38da308d25500601c9fff8fc04bf6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368919, "uuid": "379adda7-1edc-444f-9119-cafc19fd0546", "comment": "Malware payload (Formbook)", "value": "d28a0cc3d306a74ebbb1b5509c99dbd0a5acbf708350cb48e65c0cbdd9b6da3d9aa644aa772ddef10b439d7337d8452d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368919, "uuid": "16e1cc03-c571-43ef-858d-f95824d71b4d", "value": "T156351224125EDD02C4A61F740E72E3B497B96ECD9922D2039FEEBD9BFA7F2601414385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368919, "uuid": "4bc1ed36-c310-4f52-97d6-c27c6a009388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368919, "uuid": "25991134-f6e7-4487-89e5-4186590fd7bb", "value": "24576:Za6UwsIRIm5e3vuAscAjqTbhHYxeZz6nKcms3SSpGfSwMy:Za69dJ5e3vur/P6zobSWwMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368919, "uuid": "32cf35ab-1bbd-40f0-8ef0-77f6c5fce3e4", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368919, "uuid": "c6d4a0cd-ed2d-4529-a772-863643926145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368919, "uuid": "748ce6c8-1205-4292-ae2f-260e7f692c1e", "value": "ff7f4f7367fedabb89215428edb505fb2748248e623fff7fcc90dbee745aa083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }